What is the main difference between a Denial of Service (DoS) attack and a Distributed Denial of Service (DDoS) attack?

Question

Options

• AThe DoS attack targets a single device, while the DDoS attack targets multiple devices.
• BThe DoS attack is carried out by a single threat actor, while the DDoS attack involves multiple
• CThe DoS attack aims to exfiltrate sensitive data, while the DDoS attack aims to disrupt services
• DThe DoS attack is illegal, while the DDoS attack is a legal form of cybersecurity testing.

• A
  90% (28)
• B
  3% (1)
• D
  6% (2)

Explanation

Note: The marked answer (A) does not align with standard cybersecurity definitions - B is the technically correct answer for this concept.

The "D" in DDoS stands for Distributed, meaning the attack originates from multiple sources (often a botnet of compromised machines), whereas a DoS attack comes from a single source. Both attacks typically aim to overwhelm the same target - the difference is in where the attack comes from, not what it targets. This makes B the accurate answer: a DoS is launched by a single attacker/machine, while a DDoS uses many distributed machines simultaneously.

Why the other options are wrong:

• A reverses the actual distinction - both DoS and DDoS can target a single victim; the difference is the attack origin, not the target count.
• C is wrong because both DoS and DDoS aim to disrupt availability, not steal data (that's exfiltration/espionage).
• D is wrong because both are illegal without authorization; neither is a legitimate testing method by definition.

Memory tip: Think of the "D" for Distributed - DDoS = attack coming from many directions at once, like a crowd rushing a single door vs. one person pushing.

If this question appears on your actual exam with A marked correct, I'd recommend flagging it - but understand the real definition (B) for applied knowledge.

No community discussion yet for this question.