What does DDoS stand for?
DDoS stands for Distributed Denial of Service. A denial-of-service attack launched from many sources at once, often a botnet, so blocking a single address does not stop it.
A DDoS attack makes a service unavailable by sending it more traffic or requests than it can handle, from many sources at once. The sources are usually thousands of compromised computers and devices, a botnet, or servers on the internet tricked into sending large replies to the victim. Because the traffic comes from everywhere, blocking a single address does not help. Defences work upstream: a scrubbing service or content delivery network absorbs and filters the flood before it reaches the victim's link.
DDoS in practice: an example
An online shop becomes unreachable on a sale day. The firewall logs show connection attempts from tens of thousands of addresses in many countries, all requesting the same search page. The provider reroutes the shop's traffic through a scrubbing service, which drops the automated requests and passes real customers.
What DDoS is confused with
DDoS vs DoS: what is the difference?
A DoS attack comes from one source and can often be stopped by blocking it. A DDoS attack is distributed across many sources, so it has to be absorbed or filtered at scale. What DoS stands for
Which exams cover DDoS?
DDoS is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 2.5 (Threats, Vulnerabilities, and Attacks).
- Network+ N10-009: 4.0 (Network Security). Listed there as “Distributed Denial-of-service”.
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A website is flooded by requests from thousands of infected home routers and cameras. What kind of attack is this?
- An on-path attack
- A DDoS attack
- SQL injection
- Privilege escalation
Show the answer
B. A DDoS attack. Many compromised devices sending traffic to exhaust one target is the definition of a distributed denial of service.
2. Why is blocking the attacker's IP address at the firewall usually not enough to stop a DDoS attack?
- Firewalls cannot block addresses
- The traffic comes from many addresses and can saturate the link before it reaches the firewall
- DDoS traffic is always encrypted
- The attack uses only local network traffic
Show the answer
B. The traffic comes from many addresses and can saturate the link before it reaches the firewall. There is no single address to block, and the flood can fill the internet link itself. Mitigation has to happen upstream, at the provider or a scrubbing service.
Sources: NIST glossary: distributed denial of service; RFC 4732: Internet Denial-of-Service Considerations. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.