A DoS attack that uses TCP flags is called a ________ attack.

• A. Both A and B
• B. half-open
• C. Neither A nor B
• D. half-close

Answer: (B)

The idea tested is that this type of DoS floods the server by exploiting the TCP three-way handshake, leaving connections in an unfinished state. In a half-open attack, the attacker sends many SYN packets to start new connections, often with spoofed IPs. The server allocates resources and replies with SYN-ACK, but the final ACK from the client never arrives, so those connections stay half-open. Those half-open states consume server resources (memory and backlog entries), eventually preventing legitimate users from establishing connections. That’s why this is called a half-open attack—the connection is initiated but never completed.

The term half-close isn’t used for this kind of attack, and the option suggesting both or neither doesn’t apply here.