Which attack type exhausts a target's maximum concurrent connections by using incomplete HTTP requests?

Which attack type exhausts a target's maximum concurrent connections by using incomplete HTTP requests?

• A. Slowloris
• B. DRDoS Attack
• C. Random Recursive GET Flood Attack
• D. Slowloris Attacks

Answer: (D)

This attacks type exploits a web server’s limited pool of concurrent connections by holding connections open with incomplete HTTP requests. The attacker opens many connections to the target and begins sending a partial request, then keeps sending just enough header data to keep the connection alive without ever finishing the request. The server must keep each open connection waiting for the rest of the request, tying up resources (threads or workers) and preventing new legitimate connections from being established. Because each connection uses minimal bandwidth but substantial server resources, the target can be overwhelmed even with modest traffic. This is why it best fits the prompt: the goal is to exhaust the maximum number of concurrent connections, not to saturate bandwidth or rely on amplification. Other attack types described generally rely on flooding with complete requests, amplification, or different resource targets, and thus don’t align with the mechanism of keeping connections open via incomplete requests.

This attacks type exploits a web server’s limited pool of concurrent connections by holding connections open with incomplete HTTP requests. The attacker opens many connections to the target and begins sending a partial request, then keeps sending just enough header data to keep the connection alive without ever finishing the request. The server must keep each open connection waiting for the rest of the request, tying up resources (threads or workers) and preventing new legitimate connections from being established. Because each connection uses minimal bandwidth but substantial server resources, the target can be overwhelmed even with modest traffic.

This is why it best fits the prompt: the goal is to exhaust the maximum number of concurrent connections, not to saturate bandwidth or rely on amplification. Other attack types described generally rely on flooding with complete requests, amplification, or different resource targets, and thus don’t align with the mechanism of keeping connections open via incomplete requests.