ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A direct denial-of-service attack is typically launched from one malicious host that sends a high-rate stream of traffic-often UDP-to exhaust the target's bandwidth or stateful filtering capacity. The traffic in the logs comes from a single, non-spoofed IP and is large enough to cause performance issues but not dispersed across many sources, making a direct DoS the most likely explanation. A distributed amplification attack would involve many spoofed IPs and much higher aggregate bandwidth, a low-and-slow application-layer attack would rely on small numbers of legitimate-looking requests, and insider data exfiltration would be seen as outbound rather than inbound traffic.