The 911 public non-emergency web tip form is overwhelmed by concurrent POST traffic from thousands of distinct source IPs worldwide. Which term correctly describes this attack?
Select an answer to reveal the explanation.
Short Explanation
Thousands of different IPs hitting the tip form at once is a flash mob, not one guy with a megaphone. That is DDoS: many sources, one goal, service on its knees. DoS is the single-hose version; this is the hydrant farm.
Full Explanation
The 911 public non-emergency web tip form is overwhelmed by concurrent POST traffic from thousands of distinct source IPs worldwide. The correct term is a distributed denial-of-service (DDoS) using many coordinated sources: availability damage from a many-origin flood against a civic public-safety tip channel. Civic framing matters because 911-adjacent web forms are critical municipal services, and the SOC must distinguish many-source floods from a single angry resident so mitigation and upstream filtering match the pattern.
Calling it a single-source denial-of-service (DoS) from one angry resident fails by concept: DoS is one origin or one method, and thousands of worldwide IPs contradict that model. Account takeover of a 911 CAD operator identity fails by concept: takeover means control of a legitimate civic identity, which a form POST flood does not demonstrate. Exfiltration of CAD incident records through the tip form fails by concept: exfiltration is data leaving the environment, whereas this event is inbound volume exhausting availability.
Exam caveat: SPLK-5001 expects DDoS when distinct coordinated sources drive the outage—do not downgrade to DoS merely because the target is a simple web form rather than a network pipe.
Operational check: Graph source-IP cardinality and geography on the tip-form posts, engage WAF and ISP/upstream filtering for the many-source pattern, keep CAD operator identity investigations separate unless auth anomalies appear, and disposition the notable as DDoS.