Certified Ethical Hacker (CEH) Practice Question

The scenario describes an amplification-based distributed denial-of-service technique. By spoofing the victim's IP address in very small Network Time Protocol (NTP) monlist requests, the attacker coerces many NTP servers to send much larger replies to the victim, producing an amplification ratio often exceeding 200×. This quickly saturates the victim's bandwidth even though the attacker transmits relatively little traffic. A TCP SYN flood and teardrop fragmentation rely on consuming state or exploiting reassembly bugs, not on reflection or amplification. Slowloris keeps HTTP sessions open with partial headers, which targets web servers and consumes their connection pools rather than amplifying traffic volume. Therefore, the only option matching the described UDP reflection and amplification behavior is the NTP amplification attack that abuses the monlist command.