Which three symptoms are best used to detect a TCP SYN flood attack?

Which three symptoms are best used to detect a TCP SYN flood attack? (Choose three.)

A.
high memory utilization on target server

B.
large number of sockets in SYN_RECV state on target server

C.
network monitoring devices report large number of unACKed SYNs sent to target server

D.
target server crashes repeatedly

E.
user experience with target server is slow or unresponsive