← IGCSE Computer Science Paper 1

Distributed denial of service (DDoS) attack

A botnet of infected computers floods one server with requests at the same time, so it cannot respond to real users and the website goes offline.

Part of: IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 16, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 141, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 41, WA Computer Science ATAR Year 11 — Network Communications — Module 99, WA Computer Science ATAR Year 11 — Cyber Security — Module 47

Understanding Distributed denial of service (DDoS) attack in IGCSE Computer Science Paper 1

What it does: Blocking one IP address stops a single-source DoS, but a DDoS has so many sources that blocking them one by one is not practical. The attacker floods the server so real users cannot reach it. They may then demand payment to stop, or simply want to cause damage to the organisation. Distributed means spread out. The attack traffic comes from many sources, not just one. A botnet is a network of infected 'bot' computers that the attacker controls. The owners normally do not know their computer is infected and being used in the attack. Malware turns the computer into a bot that the attacker can control remotely.

Common mistakes: The server only goes offline when the botnet's requests are greater than its capacity. The test should be IF requests > capacity THEN. In a DDoS attack the botnet sends the requests to the target server, not the other way round. It should be botnet.send(requests, server).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Distributed denial of service (DDoS) attack to a class →

This module's key terms are also in a printable crossword (Modules 520–546) and word search (Modules 510–546).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What does the 'distributed' part of a DDoS attack mean?
The requests come from one computer sending data very fastThe requests come from many different computers at once
Matches
A DDoS attack uses one computer to send requests to a server
↓
A DDoS uses many computers (a botnet) at the same time, not one. One computer sending requests is a simple DoS attack.
Applying
Meanings
Term
DDoS attack
Meaning
A botnet of infected computers floods one server with requests at the same time, so it cannot respond to real users and the website goes offline.
Practice
FOR EACH bot IN botnet
Testing
Gaps
A is a group of infected computers
Check Answer
Spots
3requests ← botnet * 2
4IF requests < capacity THEN

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Golden Phoenix' badge — Savannah Legend, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does the 'distributed' part of a DDoS attack mean?
A. The requests come from many different computers at once ✓
B. The requests come from one computer sending data very fast
Distributed means spread out. The attack traffic comes from many sources, not just one.
2. Which group of computers is used to carry out a DDoS attack?
A. A firewall of computers protecting the server
B. A botnet of computers infected with malware ✓
A botnet is a network of infected 'bot' computers that the attacker controls.
3. Who controls the bots in a botnet?
A. The attacker, usually without the owners knowing ✓
B. The owners of the computers, who choose to join in
The owners normally do not know their computer is infected and being used in the attack.
4. Why is a DDoS attack harder to block than a DoS attack from one computer?
A. The traffic comes from many different addresses, so one address cannot just be blocked ✓
B. The traffic is encrypted, so the server cannot read the requests
Blocking a single IP address stops a DoS attack, but a DDoS comes from thousands of addresses.
5. What happens to the target server during a DDoS attack?
A. It is sent a virus that deletes all the files stored on it
B. It is flooded with requests and cannot respond to real users ✓
The server is overloaded with traffic, so genuine users cannot get through. The aim is not to delete files.

Match the Pairs

botnet → A group of computers infected with malware that an attacker controls remotely and uses to send requests to a target
DDoS attack → Many infected computers flood one server with requests at the same time so it cannot respond to real users
Why a DDoS is harder to block than a DoS: the requests come from thousands of different IP addresses, not one → sources = 50000 # many IP addresses
An attacker's aim in a DDoS: take a website offline, or demand payment or cause damage → aim = 'website offline / demand payment'
A DDoS attack uses one computer to send requests to a server → A DDoS uses many computers (a botnet) at the same time, not one. One computer sending requests is a simple DoS attack.
A DDoS attack steals the files stored on the server → A DDoS does not steal data. It floods the server with requests so it cannot respond to real users, and the website goes offline.

Key Term

DDoS attack
A botnet of infected computers floods one server with requests at the same time, so it cannot respond to real users and the website goes offline.

Fill in the Blanks

1. A botnet is a group of infected computers
Hint: Type the name for a network of infected computers controlled by an attacker
2. DDoS = Distributed Denial of Service
Hint: Type the word that comes after Distributed in the attack's name
3. Blocking one IP stops a DoS but not a DDoS
Hint: Type the acronym for the attack that comes from many sources
4. Bots are computers infected with malware
Hint: Type the kind of harmful software that turns a computer into a bot
5. Aim: take a site offline or demand payment
Hint: Type the state the attacker wants the website to be in

Spot the Error

Question 1
A botnet ← 5000
B capacity ← 1000
C requests ← botnet * 2
D IF requests < capacity THEN
E server ← "offline"
F ENDIF
Line D — The server only goes offline when the botnet's requests are greater than its capacity. The test should be IF requests > capacity THEN.
Question 2
A attacker.infect(computers)
B botnet ← infected_computers
C server.send(requests, botnet)
D server.status ← "overloaded"
Line C — In a DDoS attack the botnet sends the requests to the target server, not the other way round. It should be botnet.send(requests, server).
Question 3
A bots ← 10000
B total ← bots + 50
C OUTPUT total
Line B — Each bot sends many requests, so the total is the number of bots multiplied by the requests per bot. It should be total ← bots * 50.
Question 4
A sources ← 20000
B blocked ← 1
C remaining ← sources + blocked
D OUTPUT remaining
Line C — Blocking one source removes it from the attack, so you subtract it. Many sources remain, which is why a DDoS is hard to block. It should be sources - blocked.
Question 5
A attack ← "DDoS"
B aim ← "steal stored data"
C OUTPUT aim
Line B — The aim of a DDoS attack is to take a website offline, or to demand payment or cause damage. It does not steal data. The aim should be something like "take site offline".

Student with a class code? Join your class →