220-1102 Question 441
Single answerDenial of service (DoS)A small company hosts its own customer portal on a single web server behind a firewall. On Monday morning, employees report that the portal is extremely slow and often unavailable from both inside and outside the network. The technician checks the server and finds CPU and memory usage are normal, but the firewall shows thousands of repeated connection attempts per second from many different public IP addresses. Which of the following is the MOST likely cause of the outage?
- A
A distributed denial-of-service (DDoS) attack is overwhelming the server or internet connection
- B
A ransomware infection has encrypted the web server's operating system files
- C
A man-in-the-middle attack is intercepting portal traffic between employees and the server
- D
An invalid SSL/TLS certificate on the portal is preventing users from authenticating
Show answer and explanation
Correct answer: A
Explanation
The best answer is a distributed denial-of-service (DDoS) attack. In A+ Core 2, candidates should recognize denial-of-service conditions by their practical symptoms: legitimate users cannot access a service, network devices show unusually high traffic, and the traffic may come from one source in a DoS or many sources in a DDoS. This scenario specifically indicates many source IP addresses, making DDoS the most likely cause. Industry best practices for responding include escalating to the ISP, enabling firewall or upstream filtering, using rate limiting where appropriate, and involving a DDoS mitigation provider or content delivery network if available. Guidance from organizations such as CISA and NIST commonly emphasizes traffic analysis, upstream coordination, and layered defensive controls when handling service-disruption attacks.
- A. Correct.
Correct. A distributed denial-of-service (DDoS) attack uses traffic from many different systems to flood a target service or network path, making it slow or unavailable to legitimate users. The key indicators in the scenario are the very high number of connection attempts per second, the large number of source IP addresses, and the fact that the server itself does not appear resource-starved. In practice, the bottleneck may be the firewall, the server's network stack, or the internet circuit rather than CPU or RAM.
- B. Incorrect.
Incorrect. Ransomware typically encrypts files and may display ransom notes, prevent logons, or stop applications from functioning normally. It would not usually present as thousands of inbound connection attempts from many public IP addresses on the firewall. A candidate might choose this because the portal is unavailable, but the network-based symptoms point to traffic flooding rather than file encryption.
- C. Incorrect.
Incorrect. A man-in-the-middle attack involves intercepting or altering communications between parties. While it can cause security issues such as credential theft or session hijacking, it does not typically generate massive volumes of inbound connection attempts from numerous IP addresses. The scenario describes service saturation, which is characteristic of DoS/DDoS activity, not traffic interception.
- D. Incorrect.
Incorrect. An SSL/TLS certificate problem can cause browser warnings, trust failures, or blocked connections, but it would not explain the firewall logging thousands of repeated connection attempts per second from many different public IP addresses. Someone might select this because users cannot reach the portal, but certificate issues affect trust and encryption, not large-scale traffic flooding.