An insurance company has an online quoting system for insurance premiums. It allows potential customers to fill in certain details about their car and obtain a quote. During an investigation, the…

A hidden field alert is a passive detection mechanism only and does not prevent or mitigate the resource exhaustion - it does not stop the customer number depletion.

Cross-site scripting involves injecting malicious client-side scripts into pages to target other users, which does not match the automated form-filling and customer number exhaustion patterns described.

Pattern 1 shows automated incremental form submissions consistent with bot activity, and Pattern 2 shows a finite resource - customer numbers - being depleted at scale, which is the definition of a resource exhaustion attack targeting a legacy system constraint.

Blacklisting known bot IPs is ineffective because distributed bots rotate across many IP addresses, making a static blacklist insufficient to prevent ongoing resource exhaustion.

SQL injection involves inserting malicious SQL syntax into input fields to manipulate the database directly, which is not indicated by the incremental form updates and customer number exhaustion patterns.

An inline WAF can identify and block automated bot traffic in real time based on behavioral patterns such as rapid sequential form submissions, while SIEM integration provides centralized alerting, correlation, and forensic visibility into the ongoing attack.

A DDoS attack aims to overwhelm network or application availability with traffic volume, which differs from the targeted resource exhaustion of a finite customer number pool described here.

Blocking individual attacker IPs is a reactive and incomplete measure since bot networks use many distributed source IPs, making per-IP firewall rules insufficient to stop the attack.