Residents cannot reach the tax-assessor site, and netflow shows a flood of SYN packets from many sources. What attack is occurring?
Select an answer to reveal the explanation.
Short Explanation
The assessor site is drowning, and the SYN flood is coming from a crowd, not one angry neighbor. Many sources plus a flood is DDoS. Defacement would change the page; a single IP would be ordinary DoS.
Full Explanation
When residents cannot reach the tax-assessor site and netflow shows a flood of SYN packets from many sources, the attack is a distributed denial of service from many sources. Availability of a civic tax-assessment service is knocked down by a multi-source SYN flood aimed at the public portal. That is DDoS in blueprint terms: many distinct sources, volumetric abuse, and a municipal service residents cannot use. It is not a single angry neighbor, not a homepage rewrite, and not a mailbox takeover invented without evidence.
Calling the event website defacement of the assessor home page fails by concept: the stem describes reachability failure and SYN flood telemetry, not altered page content or vandalized HTML. Calling it a single-host denial of service from one resident IP fails by concept: many sources are explicitly present in the netflow picture, which is the distinguishing mark of distributed denial. Calling it account takeover of the assessor's mailbox fails by concept: mailbox control is not evidenced by SYN floods against the public website.
Exam caveat: Many sources plus volumetric flood plus civic service unreachable equals DDoS; one source would be ordinary DoS.
Operational check: Engage DDoS mitigation with the ISP or scrubbing service, preserve netflow and Enterprise Security web telemetry for later analysis, communicate assessor service status to residents, and avoid treating the event as defacement without page-change evidence.