Learning objectives
- Distinguish network and HTTP attack surfaces
- Identify the exhausted resource
- Check bypass paths and legitimate traffic
The mental model
A distributed denial-of-service attack attempts to make a service unavailable by consuming resources from many sources. The exhausted resource may be network bandwidth, connection state, or expensive application work. Layer 3 and Layer 4 attacks target network and transport behavior; Layer 7 attacks use application requests and can resemble ordinary traffic. The distinction changes the mitigation and evidence you need. Blocking a costly URL at the application layer does not restore an already saturated upstream link. Adding bandwidth does not fix an endpoint that performs unbounded database work. A layered design identifies the scarce resource and places protection where it can act before that resource is exhausted.
How it works
Start with a resource model: ingress capacity, packet processing, connection tables, TLS work, HTTP handling, application concurrency, and downstream dependencies. Observe rates, errors, latency, and saturation at each relevant boundary. A high request rate can be a legitimate campaign, while a relatively modest rate against an expensive operation can still cause denial of service. Traffic volume alone does not establish intent.
Cloudflare documents distinct network-layer and HTTP DDoS protections. The applicable traffic path and service matter: protecting proxied web traffic is not equivalent to protecting every arbitrary service or an exposed origin address. Verify that intended traffic reaches the mitigation layer and assess direct-origin exposure. During an incident, preserve useful evidence while applying supported mitigations with a clear scope. Watch legitimate customer success rates alongside attack metrics. After mitigation, check whether the bottleneck moved to the origin or another dependency. A resilient architecture combines upstream capacity and filtering with application limits, caching where safe, backpressure, and recovery procedures. Do not promise that a vendor service makes all downtime impossible. Define expected behavior, monitoring, and escalation against the customer's actual architecture.
Applied example · hypothetical
Hypothetical example: a public API experiences a surge of requests to an expensive report endpoint. Bandwidth remains normal, but database CPU and request queues rise sharply. The attack resembles valid HTTP, so a network-only explanation is insufficient. The team applies a scoped policy, protects legitimate tenants, and introduces bounded report execution. In a different incident, a raw packet flood saturates connectivity before requests reach the application. The two events share an availability impact but require protection at different points in the path and different measures of success.
In a customer engagement
In a Cloudflare engagement, confirm which addresses, protocols, and hostnames are protected and which remain directly reachable. Ask about previous attack patterns and critical legitimate traffic. Explain that HTTP and network-layer mitigation address different attack surfaces. During evaluation, use authorized test methods and document operational response; do not create disruptive traffic merely to make a demo impressive.
Interview relevance
A strong answer identifies the resource under pressure before selecting a control. Explain Layer 3/4 versus Layer 7 in terms of packet, connection, and application work. Include origin bypass and legitimate traffic as considerations. Interviewers are looking for incident judgment, not a promise of absolute protection.
Common mistakes
- Assuming all DDoS is bandwidth flooding
- Ignoring a directly exposed origin
- Measuring blocked volume without customer success
Key terminology
DDoS — A distributed attempt to deny service by exhausting or disrupting resources.
Layer 7 attack — An attack using application-layer behavior, such as expensive HTTP requests.
Origin bypass — Traffic reaching the origin directly and avoiding the intended edge controls.
Explain it without the page
- What resource can your most expensive endpoint exhaust?
- How would you verify that traffic cannot bypass the intended controls?
Further reading
Sources explain the underlying concepts; examples and practice answers are original course material. Recheck current limits and plan eligibility before a real proposal.