Western Governors University (WGU) ITAS2140 D431 Digital Forensics in Cybersecurity Practice Exam

A SYN flood is categorized as a DoS attack, specifically aimed at overwhelming and disrupting a target system's ability to respond to legitimate requests. This type of attack exploits the TCP handshake process by sending a flood of SYN requests to a target server, while never completing the handshake. As a result, the server becomes inundated with half-open connections, leading to resource exhaustion that can prevent the server from processing legitimate traffic.

In this context, while it can be considered a denial-of-service attack, it's crucial to understand that the term DoS (Denial of Service) typically refers to attacks that come from a single source. A distributed denial-of-service (DDoS) attack involves multiple compromised systems targeting a single system, which is a broader concept than a SYN flood. Therefore, while a SYN flood can be a part of a DDoS attack if conducted from multiple sources, it is fundamentally a form of DoS attack. This distinction underpins why the answer accurately identifies the nature of a SYN flood.