Cisco Certified Internetwork Expert (CCIE) Practice Test

How does TCP Intercept react to a SYN request when enabled in its default mode?

1. It drops the connection

2. It intercepts the SYN before it reaches the server and responds with a SYN-ACK

3. It allows the connection without inspection

4. It monitors the attempted connection and drops it if it fails to establish within 30 seconds

The correct answer is: It intercepts the SYN before it reaches the server and responds with a SYN-ACK

When TCP Intercept is enabled in its default mode, it intercepts the SYN request before it reaches the server and responds with a SYN-ACK. This mechanism is essential for mitigating SYN flood attacks, which are a form of denial-of-service attack. By intercepting the SYN packets, TCP Intercept can effectively manage and control the connection requests directed at the server, ensuring the server remains responsive under attack. The process works as follows: when a client sends a SYN request to initiate a TCP connection, TCP Intercept captures that request and sends a SYN-ACK response back to the client. The server remains protected from the initial SYN packet since it never sees it. This allows the server to handle legitimate requests without being overwhelmed by malicious traffic. Once the client receives the SYN-ACK, it completes the handshake by sending back an ACK. Only after this handshake process does TCP Intercept allow the corresponding connection through to the server—assuming the handshake completes successfully. This additional layer of validation ensures that only genuine connection requests are processed, enhancing the overall security and performance of the system. Other choices do not align with the standard behavior of TCP Intercept in its default mode. For instance, dropping connections outright or allowing them without inspection does not provide the same level