What is a DDoS attack?

DoS vs DDoS: what “distributed” changes

A denial-of-service (DoS) attack comes from a single source — one machine sending enough traffic or malformed requests to disrupt a target. It’s relatively easy to defend against, because blocking one attacking address usually solves the problem. A distributed denial-of-service (DDoS) attack spreads the same idea across many machines at once, often a botnet — a large number of compromised devices controlled by an attacker without their owners’ knowledge. Blocking any single source barely dents an attack coming from thousands of them simultaneously, which is exactly why the distributed version is the one organisations plan around.

Two broad types of DDoS attack

Beginners don’t need every attack variant, but the two broad families are worth knowing because the right defence differs for each.

• Volumetric (network-layer) attacks simply try to consume all available bandwidth or network capacity, burying the target under sheer traffic volume so legitimate requests can’t get through.
• Application-layer attacks target the application itself rather than the network pipe — for example, repeatedly requesting an expensive page or action so the application’s own resources (CPU, database connections) are exhausted, even though the raw traffic volume may look modest.

The impact: downtime, not theft

The defining harm of a DDoS attack is unavailability — a website that won’t load, an API that times out, a service customers can’t reach. That alone can be costly for any business that depends on being reachable, and it’s a distinct threat from data breaches: a DDoS attack typically isn’t trying to read or steal your data, it’s trying to make your system unusable while the flood lasts. Attacks can end as suddenly as they start once the attacker stops or a defence absorbs the traffic.

How defences work

Because the attack is about overwhelming capacity, the core defensive idea is absorbing or filtering traffic before it reaches anything fragile. Content delivery networks spread traffic across many geographically distributed locations, so a flood aimed at one place is diluted across a wider footprint instead of hitting a single server directly. Purpose-built DDoS protection services — AWS Shield is the AWS example — sit in front of applications specifically to detect and absorb these floods at scale, distinct from the application itself having to cope. A firewall adds another layer, filtering traffic by rules before it reaches your servers.

Application-layer attacks need a different tool than raw traffic absorption, because the requests themselves can look legitimate. A web application firewall — AWS WAF is the AWS example — inspects requests at the application layer and can block patterns that look like an attack (excessive requests from one source, malicious payloads) even when the overall traffic volume isn’t enormous. In practice, robust protection layers several of these together: a CDN and dedicated DDoS protection to absorb volumetric floods, and a web application firewall to filter application-layer abuse, rather than relying on any single defence.

Why cloud platforms take this seriously

Cloud providers build DDoS resilience into their networks by default at the infrastructure level, then offer additional managed protection for customers who need more — because a successful attack against shared infrastructure could, in principle, affect more than one customer. For anyone running a public-facing application, understanding this isn’t just exam material: enabling the equivalent of a CDN, a managed DDoS protection service and a web application firewall on your own workload is a standard, practical hardening step, and it’s exactly the kind of scenario security-focused certification exams like to test.