A distributed denial-of-service attack floods a service with traffic until legitimate users cannot connect. Which security goal is directly affected?

### Why this is right The scenario describes legitimate users being unable to use a service. That is an availability failure, whether the cause is malicious traffic, a hardware fault, or another disruption. ### The concept **Availability** means authorized users can access usable information and services when needed. A **distributed denial-of-service attack** uses traffic from multiple sources to overwhelm a target's ability to respond. The attack does not need to read or change the target's data to cause harm; preventing legitimate access is enough. Encryption does not generally stop this kind of attack, because network resources can be consumed before protected data is reached or read. ### The other options - **A. Confidentiality**: This concerns unauthorized viewing or disclosure. It would fit an attacker stealing private records, not merely making a service unreachable. - **B. Integrity**: This concerns unauthorized or undetected changes to information. The scenario describes blocked access, not altered data. - **D. Authentication**: This is checking identity. It is a process that can support security, not one of the three CIA security goals asked for here. ### Terms - **Distributed denial-of-service attack**: An attack that uses traffic from multiple sources to overwhelm a service and prevent legitimate access. - **Availability**: The ability of authorized users to access usable information or services when required. - **Confidentiality**: Protection against unauthorized access or disclosure. - **Integrity**: The property that data remains accurate and is changed only as authorized. - **Authentication**: Checking the identity of a user or system. ### Remember If legitimate users cannot reach a service, identify availability as the directly affected goal.