An employee in the credit branch department of a large bank reported a slowdown of software used for issuing and assigning credit cards to customers. According to bank policy, any case involving…

Question

Options

• Apossible SQL injection attack to extract data through an application by HTML responses with the goal to infiltrate sensitive data and affect confidentiality
• Bpossible network worm that is sending HTTP responses to all visible hosts on the network with the goal of reconnaissance for a potential attack
• Cpossible malware that is generating fake HTTP responses to affect SQL database tables with the goal to corrupt the database and affect integrity
• Dpossible HTML flood attack focused on bringing down the software by sending higher-sized requests with the goal to suspend business operations and affect availability

• A
  5% (1)
• B
  10% (2)
• C
  14% (3)
• D
  71% (15)

Explanation

Option D is correct because the defining symptom - a dramatic spike in HTML response sizes (from ~100 KB to 20–50 MB) combined with software slowdown - is the classic fingerprint of a flood/volumetric DoS attack. The attacker sends requests engineered to generate abnormally large server responses, exhausting resources and degrading availability, which directly maps to the CIA triad's "availability" pillar mentioned in the answer.

Why the distractors fail:

• A (SQL injection) targets confidentiality by extracting data, but the scenario shows no signs of data exfiltration or unauthorized query results - just oversized responses slowing the system.
• B (Network worm) propagates by scanning and copying itself to other hosts; a worm wouldn't manifest as inflated HTML responses from a single application.
• C (Database-corrupting malware) would produce data integrity errors or corrupted records, not massive HTTP response sizes causing a slowdown.

Memory tip: Anchor the answer to the CIA triad using the keyword clues each option drops:

• "extract data / confidentiality" → SQL injection (A)
• "reconnaissance" → worm (B)
• "corrupt / integrity" → malware (C)
• "suspend operations / availability" → flood attack (D)

When you see slowdown + bloated responses, the attack goal is to deny service, so map it to availability = flood.

No community discussion yet for this question.