Is the statement 'Most DoS attacks are difficult to detect' true or false?

• A. True
• B. False
• C. Not sure
• D. Cannot determine

Answer: (B)

Detectability is the focus here. DoS attacks disrupt service by creating abnormal traffic or resource usage, which is exactly what network and security monitoring looks for. When a flood starts, you usually see a sharp spike in bandwidth, a surge in connection attempts, or suddenly high CPU/memory load on a target, and these signals trigger alerts in IDS/IPS, firewalls, and SIEM systems. Even the more subtle application-layer DoS attacks tend to produce unusual request patterns or slower-than-normal responses over time, which modern anomaly detection and rate-limiting can identify. While there are stealthy, low-rate variants, they’re not the typical case, and defenses increasingly use behavior analysis to catch them as well. Because of these monitoring capabilities, the idea that most DoS attacks are difficult to detect isn’t accurate.