Which best describes how a smurf flood DoS attack operates?

• A. It relies on a single target to receive many responses
• B. It uses large authenticated packets
• C. Spoofed ICMP echo requests are sent to a broadcast address, causing multiple replies to the victim
• D. It requires no amplification

Answer: (C)

Smurf flooding works by abusing broadcast networks and spoofed addresses. An attacker sends ICMP Echo Requests with the victim’s IP as the source and targets the broadcast address of a network. All hosts on that broadcast network reply to the spoofed source IP, which is the victim. Because many devices respond, the victim is hit with a large volume of ICMP Echo Replies, rapidly saturating their connection. This is an amplification attack—the single spoofed request yields multiple responses directed at the victim.

The other options don’t fit because they don’t describe how the broadcast-based amplification works, nor do they reflect the spoofing and multiple replies from many hosts that characterize a smurf attack.