In a high-tech firm located in Austin, Texas, cybersecurity analyst Dr.

The correct answer is C because the defining feature of the incident is that the attackers flooded the organization’s online services with illegitimate requests until legitimate users could no longer access them. That is the classic operational effect of a Denial-of-Service attack. CHFI v11 covers network and web application threats and attacks, including service disruption scenarios that affect organizational operations. The question does not describe unauthorized privilege gain, repeated password guessing, or deceptive messaging aimed at tricking users, so privilege escalation, brute force, and phishing do not fit as well. What matters here is the deliberate exhaustion of service availability. From a forensic viewpoint, this kind of event is usually recognized through abnormal traffic volume, connection floods, incomplete sessions, or repeated application requests designed to consume bandwidth, server threads, or processing resources. Because availability is the primary security property being attacked and the platform becomes unreachable to legitimate customers, the most accurate classification is a Denial-of-Service attack. That aligns directly with CHFI’s focus on identifying attack categories from their observable effect on systems and services.