One angry resident saturates the city's parks-reservation form from a single home IP until the page stops responding. Web logs show no botnet, no distinct source swarm, and no account theft. Which term correctly describes this event?

One angry resident saturates the city's parks-reservation form from a single home IP until the page stops responding, with web logs showing no botnet, no distinct source swarm, and no account theft. The correct term is a denial-of-service (DoS) attack from a single source: availability damage driven by one origin or one method that exhausts a civic service. Civic framing matters because parks and permitting portals are public-facing municipal systems that can be taken offline without malware or credential theft.

Calling the event a distributed denial-of-service (DDoS) from many coordinated sources fails by concept: DDoS requires many distinct, coordinated origins, and the evidence is a single residential IP. Labeling it a botnet command channel from a fleet of licensing kiosks fails by concept: a botnet is a controlled collection of compromised hosts reporting to a controller, which is not shown. Treating it as an advanced persistent threat campaign against parks staff fails by concept: APT denotes a capable, long-term adversary campaign, not a one-source form flood.

Exam caveat: SPLK-5001 availability questions expect DoS versus DDoS to turn on source count and coordination—one home IP is DoS even when the civic outage looks severe.

Operational check: Confirm unique source cardinality in web and WAF logs, rate-limit or block the residential IP with the ISP if needed, disposition the notable as single-source DoS, and avoid opening a multi-source DDoS playbook when telemetry shows one origin.