Explain data interception and DDoS attacks
Describe threats to data in transit and service availability, including the purpose of each attack.
Exam scope and assessment notes
This sequence follows Cambridge IGCSE Computer Science 0984, 2026–2028 syllabus Version 4. It covers subject content sections 5.1–5.3 only. The separately published 2029–2031 syllabus is not mapped here. Practice is original, self-checked and does not award an official Cambridge grade. Full timed papers and human subject-teacher review remain outstanding. Cambridge states that 0984 has the same 2026–2028 subject content as 0478, with 9–1 grading. In June and November, Cambridge lists 0984 in Administrative zone 3 and for centres in Oman and the UAE. Confirm availability for your centre and exam series with Cambridge International. The separately published 2029–2031 syllabus changes to Python 3 only and removes pseudocode; this 2026–2028 route does not cover those changes.
Before you begin
- No programming language is required. Be comfortable with place value and multiplication; each lesson introduces the computer-science notation it uses.
Work on paper. Try each question before revealing help, and explain why your method works.
Quick readiness check
What does data interception target?
What you will learn
- Describe interception of data in transit
- Describe how DDoS traffic overwhelms a service
- Distinguish confidentiality from availability
One attack watches traffic; another overwhelms a service
Data interception occurs when an attacker captures data as it travels between devices, for example over an insecure network. The aim may be to read private information or obtain credentials; an attacker may also attempt to alter traffic.
Apply and check the rule
A distributed denial-of-service (DDoS) attack uses many devices to send traffic to a target service so it becomes overloaded and unavailable to legitimate users. Interception threatens the confidentiality or integrity of information; DDoS primarily targets availability.
Pause and explain
A network service is overwhelmed by traffic from many sources. What is the likely threat?
Worked example
A shop server receives traffic from thousands of compromised devices and customers cannot access it. Identify the attack and aim.
Show the worked solution
- Many devices send traffic at the same target.
- The server's capacity is overwhelmed.
- The service becomes unavailable to intended users.
Answer A DDoS attack overwhelms the service to deny availability to legitimate customers.
Try a topic test
Choose Easy, Normal or Difficult. Save your answers and open worked review after finishing.
Test this topic →From guided practice to a new situation
Write your answer and reasoning first. Use a hint only if you are stuck. The model solution is for self-checking; your written work is not automatically marked.
Explain one risk when private data is intercepted during transmission.
Give me a hint
Describe what the attacker gains access to.
Compare my reasoning
- The attacker captures data travelling between devices.
- The data may include login credentials or personal details.
- The information could be read or misused.
Interception may expose private information or credentials while they travel, allowing an attacker to misuse them.
Look for these in your work
- In-transit capture
- Example data
- Consequence
Compare the main aim of data interception with the main aim of a DDoS attack.
Give me a hint
Use the confidentiality and availability ideas.
Compare my reasoning
- Interception captures information in transit.
- DDoS overwhelms a service with distributed traffic.
- The first threatens confidentiality; the second targets availability.
Interception aims to obtain transmitted data; DDoS aims to make a service unavailable.
Look for these in your work
- Interception process
- DDoS process
- Aims contrasted
A club website slows down on event day. Explain why this alone does not prove it is under DDoS attack, then name evidence that would support that diagnosis.
Give me a hint
A slow service can have ordinary causes.
Compare my reasoning
- High legitimate demand or server faults can also cause slowdown.
- A DDoS diagnosis needs evidence of hostile, distributed traffic overwhelming the target.
- Traffic source patterns and server logs can help distinguish causes.
Slowness alone is not proof: legitimate visitors or a fault can overload a site. Evidence of coordinated hostile traffic from many sources would support a DDoS diagnosis.
Look for these in your work
- Alternative cause
- DDoS evidence
- Careful conclusion
Common mistakes
- Calling any busy website a DDoS attack without evidence of hostile traffic
- Saying interception and denial of service have the same aim
What can you explain now?
Which attack mainly aims to make a service unavailable?
Compare with the explanation
DDoS
Distributed traffic overload can prevent legitimate requests from being served.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.
Make it stick
What is the main difference between interception and DDoS?
If you needed the solution, close it and solve the problem again from a blank page. A correct answer is stronger when you can explain the reason for each step.