The city's public website is unreachable while edge logs show huge inbound UDP replies from many third-party resolvers after small spoofed queries. Which network attack pattern best matches these indicators?

Amplified reflected DDoS saturates a target by spoofing the victim’s address in small queries to third-party services that return much larger responses. Huge inbound UDP replies from many resolvers after small spoofed queries, with the city’s public website unreachable, is the classic amplification/reflection pattern: the city absorbs traffic it never originated. Civic websites and DNS edges are frequent targets because outage is immediately visible to residents.

Password spraying producing scattered lockouts across Active Directory is an authentication-bruteforce variant against many accounts; lockouts are identity symptoms, not UDP reply floods from resolvers. Impossible-travel alerts on a single administrator account flag geographic session anomalies for one identity, not volumetric website saturation. Keylogging on a finance workstation before ACH submit is endpoint input theft, unrelated to edge capacity exhaustion.

Exam caveat: distinguish volumetric reflected/amplified DDoS from application-layer floods and from credential attacks. Spoofed small queries plus oversized third-party replies is the amplification tell. Do not pick spraying or impossible travel merely because those also appear in identity chapters.

Operational check: engage upstream provider or scrubbing services, enable anti-spoofing and rate limits, verify authoritative DNS and web origin health separately from the flood, document resolver abuse sources for abuse desks, and ensure public status communications so residents know services are under attack rather than permanently offline.