A Distributed Denial of Service (DDoS) attack tries to make a system, service, or network unavailable by overwhelming it with traffic from many compromised sources at the same time.
Because the flood arrives from thousands of hosts, often a botnet of hijacked devices, there is no single address to block. Attacks come in a few flavors: volumetric floods that saturate bandwidth, protocol attacks that exhaust connection state, and application-layer attacks that hammer expensive requests. Amplification techniques abuse open DNS or NTP servers to turn a small query into a large response aimed at the victim.
The reason DDoS is hard to stop is that much of the traffic can look legitimate, so defenders rely on upstream scrubbing services, content delivery networks, rate limiting, and generous capacity rather than a firewall rule. Of the CIA triad, this is the classic attack on availability.
Why does DDoS matter for the CISSP?
It is covered in Domain 4, Communication and Network Security, which is 13% of the exam. Know how the attack types differ, why availability is the target, and which mitigations act upstream instead of at the host you are trying to protect.