Cyber Threats and Attacks Explained: Types, Worked DDoS Example and Exam Traps

Threat, vulnerability, exploit, vector, malware and impact look easy as isolated definitions. Exam scenarios become harder when they mix those terms into one incident and offer near-identical options. Read each case in order: asset, actor or source, surface, vector, vulnerability, attack action, impact, evidence and control. Then calculate the HTTP flood load and test each label against the facts. Revise the surrounding syllabus through CS Fundamentals.

Separate threat, vulnerability, exploit and attack

An asset is worth protecting. A threat actor or source can cause harm; a threat is a possible harmful event. The attack surface contains reachable points. A vulnerability is an exploitable weakness, an exploit is the method or code that uses it, and an attack vector is the route. An attack is the actual attempt. An incident is a compromising or threatening event, impact is the harm, and a control changes likelihood, impact, detection or recovery.

For example, student results are the asset and a credential thief the actor. A phishing email is the vector, a fake login page the technique, and missing MFA the vulnerability. Using the stolen password is the attack. Unauthorised result access harms confidentiality. MFA and login alerts are controls.

Use this chain: asset -> actor/source -> surface -> vector -> vulnerability -> attack action -> impact -> evidence -> control. A vulnerability can exist without exploitation. An attempted attack can also fail without becoming a successful incident.

Classify attacks by security objective, activity and method

Use the CIA triad to classify the stated consequence. Unauthorised disclosure harms confidentiality, unauthorised alteration harms integrity, and interruption harms availability. One incident can affect several properties, so classify the named consequence instead of forcing the complete incident into one box.

A passive attack observes without altering communication. Eavesdropping and traffic analysis fit here. An active attack changes, injects, reuses or disrupts something, including masquerade, replay, message modification and denial of service. Passive does not mean harmless. Active does not automatically mean malware.

Method labels answer a different question. Social engineering manipulates people, and phishing is a delivery technique. Malware is unwanted software. A virus attaches to a host, a worm can self-propagate, and a Trojan disguises its purpose. Ransomware describes extortion behaviour or a payload, not one universal propagation method. DoS describes an availability objective, while DDoS uses multiple distributed sources.

Quick checks:

• Reading packets without changing them is passive and harms confidentiality.

• Altering a bank-transfer amount is active and harms integrity.

• Flooding a service is active and harms availability.

Read the running incident as an attack chain

Consider illustrative inputs for a college admissions portal. Normal demand is 3,500 HTTP requests/second, and the application tier can sustain 12,000 requests/second. A botnet operator controls 340 compromised devices, each sending 30 requests/second to the public /login endpoint. The control gap is the absence of effective upstream traffic scrubbing and request-rate control. The Application Layer Protocols: DNS and HTTP Guide provides the protocol context for identifying /login as an HTTP endpoint.

Now label the chain without calculating yet:

• Asset: portal availability

• Actor: botnet operator

• Attack resources: 340 bots

• Surface: public login service

• Vector: distributed HTTP requests

• Vulnerability or control gap: traffic reaches a capacity-limited tier without adequate filtering

• Action: coordinated flood

• Intended impact: loss of availability

• Evidence: a sudden distributed request surge in gateway and application logs

Multiple source addresses can target one destination, but the number of sources alone does not prove who controls them. Record evidence before attribution.

Worked example: calculate whether the HTTP flood overwhelms the portal

Use the stated request rates to calculate offered load before and after filtering.

First calculate the malicious load:

340 bots x 30 requests/second = 10,200 requests/second

Add normal demand to find the total offered load:

10,200 + 3,500 = 13,700 requests/second

Compare that total with application-tier capacity:

13,700 - 12,000 = 1,700 requests/second above capacity

Relative to capacity, the overload is:

(1,700 / 12,000) x 100 = 14.17%

Therefore, the stated application-tier capacity is exceeded under this model. That is the only conclusion supported so far.

Now suppose upstream filtering blocks 85% of malicious requests and blocks no normal traffic. The malicious load that remains is:

10,200 x (1 - 0.85) = 10,200 x 0.15 = 1,530 requests/second

As a check, 85% of 10,200 is 8,670 blocked requests/second, and 10,200 - 8,670 = 1,530. The post-control total and remaining capacity are:

1,530 + 3,500 = 5,030 requests/second

12,000 - 5,030 = 6,970 requests/second

The control mitigates this stated flood, but the threat and some malicious traffic remain. Apply 85% only to malicious traffic, keep every value in requests/second, and do not infer which legitimate requests fail from aggregate capacity alone. A real system may bottleneck earlier at a link, load balancer, connection pool or database. Capacity arithmetic supports an availability conclusion, not actor attribution.

Match controls to the attack stage they can change

Controls have different roles. Preventive controls include MFA, patching, least privilege, parameterised database operations, segmentation, request-rate controls and upstream traffic scrubbing. Detective controls include centralised logs, anomaly alerts, integrity monitoring and intrusion detection. Corrective and recovery controls include credential revocation, isolation, clean restoration and a tested incident-response process.

Match a control to the stage it can change. MFA reduces harm from a stolen password, but it does not stop an HTTP flood. Parameterised database operations reduce injection risk, but they do not remove excessive database privilege. Traffic filtering and rate controls address the worked availability attack, but they do not remove malware already running on an endpoint. The TCP vs UDP: Transport Layer Explained guide shows why protocol context matters when designing filtering rules. Neither protocol is inherently secure.

Defence in depth means overlapping controls across identity, endpoint, network, application, data, detection and recovery. No single firewall, antivirus product, backup or encryption setting makes a system secure. A backup can support recovery after destruction or ransomware, but it cannot undo data disclosure.

Common traps that produce the wrong option or calculation

Map CIA narrowly. Data theft harms confidentiality, unauthorised alteration harms integrity, and HTTP floods harm availability. Add secondary effects only if stated.

Do not subtract 85% from the combined 13,700. Filtering applies only to the 10,200 malicious requests/second. Since 15% remains, malicious traffic becomes 1,530 and total traffic 5,030, not zero. The 6,970 is headroom, not filtered traffic. A threat can precede an attack; an incident requires assessment or response.

How exam-style questions test cyber threats and attacks

Practise these six durable forms:

1. Label actor, vector, vulnerability, exploit, attack and impact.

2. Map a consequence to confidentiality, integrity or availability.

3. Distinguish passive observation from active change or disruption.

4. Match behaviour to virus, worm or Trojan.

5. Choose a stage-appropriate control.

6. Compute load or residual traffic from the values given in the question.

Retrieve the case. No upstream filtering is the control gap, not the actor. Malicious load is 10,200 requests/second. The pre-control total exceeds capacity by 1,700 requests/second. Blocking 85% of malicious traffic leaves total load at 5,030 requests/second. Observing credentials in transit is passive if nothing changes, while replaying them is active.

Cyber threats and attacks in the short version

Remember the chain: asset -> actor/source -> surface -> vector -> vulnerability -> action -> impact -> evidence -> control. Ask what was exposed, altered or interrupted; whether the attacker only observed or actively changed or disrupted; and which safeguard changes likelihood, impact, detection or recovery.

Next, reproduce 340 x 30 = 10,200, 10,200 + 3,500 = 13,700, and the post-filter total 5,030 without looking. Then relabel the incident chain. For wider preparation, use Zero to Hero Complete CS Course or the placement-focused CS Fundamentals for Placements by Sanchit Sir.