Which attack involves flooding a web server with application-layer web requests?

• A. SYN flood
• B. Ping flood
• C. UDP flood
• D. HTTP flood

Answer: (D)

An HTTP flood targets the web server at the application layer by sending a large number of HTTP requests to exhaust the server’s resources—CPU time, memory, and available worker processes needed to handle each request. This type of attack uses legitimate-looking traffic (GETs, POSTs, etc.) to push the server to process as many application-level tasks as possible, which can be harder to detect and mitigate than purely volumetric floods.

This differs from floods at other layers: a SYN flood overwhells the server by exhausting TCP state during the handshake; a Ping flood floods with ICMP Echo requests at the network layer; a UDP flood sends large volumes of UDP datagrams to consume bandwidth or trigger costly responses. Because it operates at the application layer, an HTTP flood specifically targets the web service and its logic, making built-in defenses like rate limiting, a Web Application Firewall, and CDN caching particularly relevant.