Exam SY0-601 topic 1 question 545 discussion

In a reflected denial of service (DoS) attack, the attacker sends requests to a large number of public servers, spoofing the source IP address to make it appear as if the requests are coming from the target server. These public servers, acting as amplifiers, then send the responses back to the target server, overwhelming it with inbound traffic. In this case, the DNS server is receiving a flood of inbound traffic due to the DNS requests being amplified by other servers. The DNS server's CPU, disk, and memory usage are minimal because it is only processing legitimate DNS queries sent to it. However, the network interface is overwhelmed with amplified responses, causing the end users to be unable to reach external websites.

D. Reflected denial of service

https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/

In a reflected denial of service (DDoS) attack, attackers send a large number of requests with a spoofed source IP address to a vulnerable server, which then responds to those requests. The responses are sent to the victim, whose IP address is spoofed in the requests, causing a flood of traffic to the victim's network. This can overwhelm the victim's network and disrupt its ability to reach external websites.

While the attack may not completely overwhelm the DNS server, it's generating a significant amount of traffic that is directed towards the victim's network. The increased volume of incoming traffic generated by the attack saturates the victim's network bandwidth and resources, causing congestion. This congestion affects the entire network's performance, making it slower and less responsive.