A2.4 Network security

NAT (Network Address Translation) maps multiple private internal IP addresses to a single public IP address when traffic leaves the network. This means external entities only see the router's public IP, not the individual device addresses.

Because internal IP addresses are hidden, an attacker scanning the internet cannot identify or directly target individual classroom devices. This is sometimes called security through obscurity — not a primary security mechanism, but a useful side effect.

NAT does not encrypt data, authenticate devices, or scan for malware. These are functions of encryption protocols, authentication systems, and antivirus/IDS tools respectively.

The statement that NAT conceals private IP addresses from the public internet correctly describes its security benefit. The correct answer is option B.

The question asks for the security benefit of NAT specifically — not what NAT does in general, but why it helps protect internal devices.

Encryption is not a function of NAT. NAT translates addresses; encryption of data in transit requires protocols like TLS or HTTPS. This option is incorrect.

Authentication is handled by systems like 802.1X, RADIUS, or login credentials — not by NAT. NAT has no mechanism to verify device identity before granting access.

Malware scanning is the role of antivirus software or intrusion detection systems, not NAT. NAT only performs address translation and does not inspect packet content.

The only accurate description is that NAT conceals private IP addresses, preventing external attackers from directly reaching internal devices. This is the correct answer.

The attack involves: (1) thousands of devices acting simultaneously, (2) devices that have been compromised (forming a botnet), and (3) the result is the target server becoming unreachable due to traffic volume.

A DDoS (Distributed Denial of Service) attack uses many compromised systems — often called a botnet — to flood a target with traffic, exhausting its bandwidth or computing resources and making it unavailable to legitimate users. This matches all three characteristics.

A regular DoS uses a single source, whereas DDoS uses many sources simultaneously. The 'distributed' element (thousands of devices worldwide) is the defining feature here, and makes blocking based on a single IP address ineffective.

The correct answer is DDoS, as it uniquely matches the scenario of multiple compromised devices overwhelming a server to cause unavailability.

The question asks us to classify the attack type based on the described behaviour: thousands of compromised devices flooding a server until it is unreachable.

SQL Injection targets a web application's database by inserting malicious SQL code into input fields. The scenario describes no database manipulation — only traffic flooding. This option is incorrect.

A MitM attack involves secretly intercepting communications between two parties. There is no mention of interception or data theft here — the attack causes unavailability, not data compromise. This option is incorrect.

Phishing involves tricking users into revealing credentials, typically via fake websites or emails. Nothing in the scenario involves deception of users. This option is incorrect.

Only DDoS matches: multiple compromised devices simultaneously flooding a target to cause a denial of service. This is the correct answer.