Information Technology Specialist (ITS) Cybersecurity Practice Exam

In a DHCP starvation attack, what do threat actors flood the server with?

1. DHCPOFFER messages

2. DHCP requests

3. DHCPCONFIRM messages

4. DHCPACK messages

The correct answer is: DHCP requests

In a DHCP starvation attack, threat actors flood the server with DHCP requests to deplete the pool of available IP addresses. By sending a large number of these requests, attackers aim to overwhelm the DHCP server and consume its resources. Each request allocated by the server reduces the number of available IP addresses for legitimate clients, effectively leading to a denial of service. This can prevent real users from obtaining network access, as the DHCP server can no longer provide IP addresses to new clients. The other options listed do not align with the mechanics of a DHCP starvation attack. DHCPOFFER messages are responses from the server offering an IP lease, while DHCPACK messages confirm that an IP address has been assigned to a client. DHCPCONFIRM messages are sent by the client to confirm its current IP address; these options either describe responses or confirmations rather than the act of flooding that characterizes the attack scenario.