ITPEC FE Morning April 2019 Question 41

Denial of Service — an attack aimed at availability: legitimate users can no longer reach the service or their accounts.

A DoS attack floods a server, network or application with more requests than it can handle, or triggers a condition that crashes it or locks accounts. Nothing needs to be stolen or read; the damage is that the rightful users are shut out. When many hijacked machines send the traffic at once, it is a DDoS attack.

Answer (b)

Why not others:

• •(a) Brute force — tries many passwords to break into an account; its goal is unauthorised access, not keeping the owner out
• •(c) Man in the middle — sits between two parties to read or alter their messages; the victims keep communicating, unaware
• •(d) Sniffing — passively captures traffic to read it; it does not disrupt anyone's access

Key rule: Classify an attack by the security property it breaks: DoS attacks availability, sniffing and man in the middle attack confidentiality (and integrity), brute force attacks authentication.

Security · AI-written, may contain errors