Palo Alto Networks Certified Network Security Administrator (PCNSA)Cybersecurity FundamentalsEasy
A cloud service provider is experiencing a massive influx of traffic from thousands of compromised IoT devices, all simultaneously attempting to access a specific web application, rendering it unavailable to legitimate users. This scenario is a classic example of which type of attack?
- ABrute-Force Attack
- BMan-in-the-Middle (MitM)
- CDistributed Denial of Service (DDoS)
- DPhishing
Show answer & explanationAnswer & explanation
Correct answer: C. Distributed Denial of Service (DDoS)
A Distributed Denial of Service (DDoS) attack involves multiple compromised systems (like IoT devices forming a botnet) flooding the target with traffic, making it unavailable to legitimate users. This perfectly matches the scenario described.
Why the other options are wrong
- A. Brute-force attacks involve systematically trying many passwords or passphrases until the correct one is found, not flooding a service with general traffic.
- B. Man-in-the-Middle attacks involve an attacker intercepting communication between two parties, not overwhelming a service with traffic.
- D. Phishing is a social engineering technique to trick users into revealing sensitive information, not a direct attack on service availability.
Distributed Denial of Service (DDoS)
A malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic from multiple compromised computer systems.
- Uses multiple compromised systems (botnet).
- Floods target with overwhelming traffic.
- Renders service unavailable to legitimate users.
- IoT devices are common components of botnets.
Memory trick: DoS attacks stop service: DDoS uses many sources, DoS uses one.