Which of the following is an attack that involves overwhelming a server with…

Cyber attacks are usually classified by the mechanism they exploit rather than by their target. Injection attacks manipulate unsanitised input so it reaches a backend system or database; interception attacks secretly capture or alter communication between two parties; credential attacks systematically guess authentication secrets to gain access; and availability attacks flood a target system with an overwhelming volume of traffic or requests so it can no longer respond to legitimate users.

The stem's defining feature is a server being overwhelmed with traffic — that is exactly the availability-attack mechanism described above. When that flood of traffic comes from many distributed, often compromised, hosts (a botnet) acting together, it is called a Distributed Denial-of-Service (DDoS) attack. This mechanism is defined purely by the volume of traffic directed at the target, not by manipulating input, intercepting a communication channel, or guessing credentials.

Comparing each option against its own defining mechanism confirms the match:

• SQL Injection exploits improperly sanitised input fields to make a database execute unintended commands — it targets data integrity/confidentiality through crafted queries, not through the volume of traffic reaching the server.

• Man-in-the-middle secretly intercepts or alters a single communication channel between two parties — it targets confidentiality and integrity of that exchange, not the server’s capacity to handle traffic.

• Brute-force repeatedly tries credential combinations to guess a valid login or key — it targets the authentication step, not the server’s ability to absorb traffic volume.

• DDoS attack floods the target with an overwhelming volume of traffic or requests from many sources so it cannot serve legitimate users — this is exactly the mechanism the stem describes.

Hence, the attack that involves overwhelming a server with traffic is the DDoS attack.