Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server's access log has the same log entry millions of times: 147.186.119.200…

Question

Options

• ADenial of Service Attack
• BDistributed Denial of Service Attack
• CCross-Site Scripting Attack
• DDatabase Injection Attack

• A
  4% (1)
• B
  81% (22)
• C
  4% (1)
• D
  11% (3)

Explanation

Option B is correct because the scenario describes a volumetric attack designed to overwhelm a web server and deny legitimate users access - the defining characteristic of a Distributed Denial of Service (DDoS) attack. The millions of identical HTTP GET requests to the /login/ endpoint flood the server's resources until it becomes unavailable; while the log shows one IP, real-world DDoS attacks use botnets with many coordinated sources, and this exam scenario reflects that scale and intent.

Why the distractors are wrong:

• A (DoS): A basic Denial of Service attack originates from a single source and smaller scale; the volume here implies distributed coordination, making DDoS the better fit in exam context.
• C (XSS): Cross-Site Scripting injects malicious scripts into web pages to target users' browsers, not to overwhelm a server with traffic.
• D (Database Injection): SQL/Database injection attacks manipulate query input to access or corrupt data - they don't involve flooding a server with repeated GET requests.

Memory tip: Think "D for Distributed, D for Devastating scale." If a server goes down from a flood of traffic across many sources, that's DDoS. If the attack manipulates data or scripts, look to C or D instead.

No community discussion yet for this question.