Which statement about botnets is true?

• A. They can be rented to conduct DoS attacks.
• B. They are always used for legitimate purposes.
• C. They cannot be controlled remotely.
• D. They require physical access to devices.

Answer: (A)

Botnets are networks of compromised devices that an attacker controls remotely, usually through a command-and-control channel. This setup makes it possible to coordinate large-scale attacks without touching the infected devices. The statement is true because there are services in cybercrime markets that rent out botnets for DDoS attacks, sometimes called DDoS-for-hire or booters. A user can pay to leverage thousands or millions of compromised devices to flood a target with traffic, choosing the attack size and duration. Since the attacker relies on remote control of the bots, physical access to the devices isn’t needed after they’re infected. This also explains why botnets aren’t used only for legitimate purposes, and why they don’t require ever-present local control.