DoS and DDoS attacks in Computer Networks - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the difference between DoS and DDoS attacks

Which statement best describes the key difference between a DoS (Denial of Service) attack and a DDoS (Distributed Denial of Service) attack?

A A DoS attack targets multiple servers at once, but a DDoS attack targets only one server.

B A DoS attack originates from a single source, whereas a DDoS attack comes from multiple sources simultaneously.

C A DoS attack uses multiple computers to flood a target, while a DDoS attack uses only one computer.

D A DoS attack is always legal, but a DDoS attack is illegal.

💡 Hint

Think about how many computers are involved in each type of attack.

A DoS attack comes from one computer or source flooding a target, while a DDoS attack uses many computers or sources to overwhelm the target simultaneously.

📋 Factual

intermediate

Common methods used in DoS and DDoS attacks

Which of the following is a common technique used in both DoS and DDoS attacks to overwhelm a target system?

A Flooding the target with excessive network traffic

B Encrypting data to protect it from attackers

C Installing antivirus software on the target system

D Phishing emails to steal credentials

💡 Hint

Consider what action directly disrupts the target's ability to respond.

Both DoS and DDoS attacks commonly flood the target with excessive traffic to make it unavailable to legitimate users.

🔍 Analysis

advanced

Impact analysis of a DDoS attack on a website

A popular online store experiences a sudden DDoS attack that floods its servers with traffic. What is the most likely immediate impact on the website's users?

A Users will experience faster loading times due to increased traffic.

B Users' personal data will be automatically deleted to protect privacy.

C Users will receive notifications about the attack and be redirected to a backup site automatically.

D Users may be unable to access the website or experience very slow responses.

💡 Hint

Think about what happens when a server is overwhelmed with too many requests.

The server becomes overloaded and cannot respond properly, causing users to face slow or no access to the website.

❓ Reasoning

advanced

Why are DDoS attacks harder to defend against than DoS attacks?

Which reason best explains why defending against a DDoS attack is more challenging than defending against a DoS attack?

A DDoS attacks use encrypted traffic that cannot be detected.

B DDoS attacks always use physical damage to servers, unlike DoS attacks.

C DDoS attacks come from many different sources, making it difficult to block all malicious traffic.

D DoS attacks only target small websites, so they are easier to handle.

💡 Hint

Consider how the number of attacking sources affects defense strategies.

DDoS attacks involve many computers sending traffic, so blocking one source does not stop the attack, making defense more complex.

❓ Comparison

expert

Comparing amplification attacks in DoS and DDoS

Which statement correctly compares amplification attacks used in DoS and DDoS attacks?

A Amplification attacks increase the attack traffic volume by exploiting vulnerable servers, and they can be used in both DoS and DDoS attacks but are more effective in DDoS due to multiple sources.

B Amplification attacks reduce the attack traffic to avoid detection and are only used in DoS attacks.

C Amplification attacks involve physically damaging network hardware and are exclusive to DDoS attacks.

D Amplification attacks encrypt traffic to hide the source and are equally common in DoS and DDoS attacks.

💡 Hint

Think about how amplification increases traffic and the role of multiple sources.

Amplification attacks exploit servers to send large amounts of traffic to a target. When combined with many sources in a DDoS, the effect is much stronger.

Practice

1. What is the main difference between a DoS attack and a DDoS attack?

easy

A. DoS attacks use viruses; DDoS attacks use worms.

B. DoS attacks websites; DDoS attacks only servers.

C. DoS uses one attacker; DDoS uses many attackers.

D. DoS attacks are legal; DDoS attacks are illegal.

Solution

1. Step 1: Understand DoS attack

   A DoS (Denial of Service) attack involves a single attacker trying to overload a system to make it unavailable.

2. Step 2: Understand DDoS attack

   A DDoS (Distributed Denial of Service) attack involves many attackers working together to overload the system.

3. Final Answer:

   DoS uses one attacker; DDoS uses many attackers. -> Option C

4. Quick Check:

   DoS = single attacker, DDoS = multiple attackers [OK]

Hint: Remember: D in DDoS means Distributed (many attackers) [OK]

Common Mistakes:

• Thinking DoS and DDoS differ by target type
• Confusing legality of attacks
• Believing DoS uses viruses

2. Which of the following is a correct description of a DDoS attack?

easy

A. Multiple computers send requests to a server simultaneously.

B. A single computer sends many requests to a server.

C. A server sends requests to multiple clients.

D. A user accidentally overloads their own computer.

Solution

1. Step 1: Identify DDoS attack behavior

   DDoS attacks involve many computers sending requests at the same time to overload a server.

2. Step 2: Eliminate incorrect options

   A single computer sends many requests to a server. describes a DoS attack, not distributed. Options C and D do not describe attacks.

3. Final Answer:

   Multiple computers send requests to a server simultaneously. -> Option A

4. Quick Check:

   DDoS = many computers attacking together [OK]

Hint: DDoS means many computers attack at once [OK]

Common Mistakes:

• Confusing single computer attack with DDoS
• Thinking server sends requests in DDoS
• Mixing accidental overload with attack

3. Consider this scenario: A website receives 1000 requests per second from one IP address, and 10,000 requests per second from 100 different IP addresses. Which attack is more likely happening?

medium

A. DoS attack from one IP address

B. DDoS attack from multiple IP addresses

C. Normal traffic spike

D. Phishing attack

Solution

1. Step 1: Analyze request sources

   One IP sending 1000 requests per second suggests a DoS attack. Multiple IPs sending 10,000 requests per second suggests a DDoS attack.

2. Step 2: Identify attack type

   Since 100 different IPs are involved, this matches the definition of a DDoS attack.

3. Final Answer:

   DDoS attack from multiple IP addresses -> Option B

4. Quick Check:

   Multiple IPs attacking = DDoS [OK]

Hint: Multiple IPs flooding = DDoS, single IP flooding = DoS [OK]

Common Mistakes:

• Choosing DoS for multiple IPs
• Confusing phishing with DoS/DDoS
• Assuming normal traffic causes overload

4. A network admin notices a sudden drop in website availability. They suspect a DDoS attack but find only one IP address flooding the server. What is the likely issue?

medium

A. The server is down due to hardware failure.

B. The attack is a phishing attempt.

C. The admin misread the logs; multiple IPs are attacking.

D. The attack is actually a DoS, not DDoS.

Solution

1. Step 1: Check attack source IPs

   DDoS attacks involve many IPs; only one IP means it is a DoS attack.

2. Step 2: Confirm attack type

   Since only one IP floods the server, the problem is a DoS attack, not DDoS.

3. Final Answer:

   The attack is actually a DoS, not DDoS. -> Option D

4. Quick Check:

   One IP flooding = DoS, not DDoS [OK]

Hint: One IP flooding means DoS, not DDoS [OK]

Common Mistakes:

• Assuming single IP means DDoS
• Ignoring hardware failure possibility
• Confusing phishing with DoS/DDoS

5. A company wants to protect its website from DDoS attacks. Which combination of strategies is most effective?

hard

A. Use a firewall, deploy traffic filtering, and employ a content delivery network (CDN).

B. Only install antivirus software on the server.

C. Disable the website during peak hours to avoid attacks.

D. Use a single strong password for all network devices.

Solution

1. Step 1: Identify effective DDoS defenses

   Firewalls can block unwanted traffic, traffic filtering can limit suspicious requests, and CDNs distribute traffic to reduce overload.

2. Step 2: Evaluate other options

   Antivirus alone does not stop DDoS. Disabling the site is not practical. Password strength helps security but not DDoS protection alone.

3. Final Answer:

   Use a firewall, deploy traffic filtering, and employ a content delivery network (CDN). -> Option A

4. Quick Check:

   Multiple layered defenses best protect against DDoS [OK]

Hint: Combine firewall, filtering, and CDN for best DDoS defense [OK]

Common Mistakes:

• Relying only on antivirus
• Thinking disabling site stops attacks
• Ignoring network traffic controls