A logistics hub sees two SYN floods on its tracking site, one from a single address and one from many addresses using the same request pattern. Which flood is distributed?
Select an answer to reveal the explanation.
Short Explanation
A crowd pushing one door is a different problem from one person pushing harder. You mark the flood from many source addresses as the distributed one. The trap is judging by the biggest packet, by DNS, or by how long the flood lasts.
Full Explanation
The right selection is "The flood arriving from many source addresses, as opposed to the flood from one address". Distributed means many sources take part in the same denial of service. Packet size, protocol, and duration do not make a flood distributed. Both floods share a request pattern, so the pattern does not separate them and the count of source addresses does. The statement "The flood that contains the single largest packet, judged by the size of that one packet" judges one packet's size, and a single large packet can come from one host. The statement "The flood whose packets are DNS queries rather than packets of some other protocol" names a protocol, and DNS is not what the word distributed measures. The statement "The flood that continues for a longer duration than the flood from the single address" names a duration, and a long flood from one address is still a single-source flood. Exam caveat: the single-address flood can still be a denial of service, and it is not the distributed one. Operational check: count unique source addresses in each flood and label the many-address flood as distributed.