Certified Ethical Hacker (CEH) Practice Question

The scenario describes an attacker who forges the victim's IP address in tiny UDP requests to Network Time Protocol (NTP) servers. Each NTP server replies with a much larger "monlist" response to the spoofed source, multiplying the traffic by hundreds of times. Because the traffic is reflected off legitimate third-party servers and greatly amplified in size, this is classified as a UDP amplification reflection attack. A TCP SYN flood relies on half-open connections, not reflection or amplification. Slowloris is an application-layer slow-rate HTTP attack and does not depend on spoofed requests or third-party reflectors. A LAND attack sends a packet with the victim's own IP and port as both source and destination, consuming some resources but offering no amplification via external services.