Sample questions
Nc Security ProtocolDifficulty 1
A UDP game server receives a small connection-request packet from a source address it has not validated yet. Why is replying immediately with a large amount of game data risky?
- aThe address could be spoofed, turning the server into an amplifier against a victim✓
- bUDP silently rejects any reply larger than the request that triggered it
- cThe OS caps outgoing UDP packets to the exact size of the last packet received
- dLarge replies always get lost since UDP requires equal request/response size
Explanation:With UDP the source address is not verified. An attacker can spoof it to point at a victim; a reply much bigger than the request makes the server an amplifier against that victim.
Nc Security ProtocolDifficulty 2
Before a client's address is confirmed real (not spoofed), a server limits how many bytes it sends to it relative to bytes received from it. What is this limit's purpose?
- aIt reduces the server's memory usage for buffering packets
- bIt compensates for packet loss on unreliable UDP links
- cIt bounds how much traffic reaches a spoofed victim✓
- dIt guarantees fair bandwidth sharing among all connected players
Explanation:Capping how much traffic reaches an unvalidated address means a spoofing attacker can only redirect a small multiple of what they sent toward the victim, making amplification unattractive.
Nc Security ProtocolDifficulty 1
Instead of accepting a client the moment a connection-request packet arrives, a server first sends a small challenge value and waits for it to be echoed. What does this protect against?
- aIt compresses the handshake to save bandwidth
- bIt confirms the client can receive packets at its claimed address first✓
- cIt negotiates which tick rate the match will run at
- dIt lets the client pick its own player identifier
Explanation:A client that cannot receive the challenge (spoofed address) can never echo it back, so the server never commits real connection state to an unconfirmed address.
Nc Security ProtocolDifficulty 2
An attacker spoofs a victim's IP and sends a fake connection-request to a game server. The server replies with a token to that (victim's) address and waits for it to be echoed before allocating a slot. What happens?
- aThe server allocates the slot anyway since the request looked well-formed
- bThe victim's machine forwards the token to the attacker automatically
- cThe attacker guesses the token because tokens are short by design
- dThe token is delivered to the victim's address, not the attacker's✓
Explanation:The reply goes to the address in the packet header (the victim's), so the attacker never sees the token and cannot echo it back to complete the handshake.
Nc Security ProtocolDifficulty 1
Why does a server avoid creating a full connection-state structure for every connection-request packet, before that request is confirmed to come from a real, reachable address?
- aAn attacker could send many fake requests to exhaust connection slots and memory✓
- bCreating the structure early makes matchmaking slower for legitimate players
- cThe engine only supports allocating state after the match has started
- dFull connection structures can only be created once per server restart
Explanation:If the server committed real state on the first packet, an attacker could flood it with spoofed requests and exhaust its slots long before any 'connection' was ever real.
Nc Security ProtocolDifficulty 2
A protocol requires the client's initial connect packet to be padded to roughly the server's challenge-response size. What does this padding rule primarily prevent?
- aIt prevents fragmentation of the request packet on the network
- bIt removes the size gap amplification relies on✓
- cIt speeds up the handshake by letting the server skip a round trip
- dIt lets the client reserve extra bandwidth for the rest of the match
Explanation:If the request must be padded near the response's size, the 'small request, big reply' ratio that makes amplification worthwhile disappears.