The correct answer is An attack that overwhelms a host with excessive requests so legitimate users cannot reach the service.

A denial of service attack denies availability by consuming the target's computing or network resources so legitimate requests cannot be processed. The attacker sends excessive traffic or requests to exhaust CPU memory connection tables or bandwidth which prevents normal users from getting a response.

Many denial of service attacks are distributed which increases volume and makes mitigation more difficult. Common defenses focus on rate limiting filtering and traffic scrubbing to reduce the impact and restore access.

An attack that attempts to circumvent authentication controls is incorrect because that option describes authentication bypass or credential attacks that aim to gain unauthorized access rather than preventing legitimate users from accessing a service.

An attack that aims to exfiltrate sensitive files from cloud storage by abusing APIs is incorrect because that option describes data exfiltration or API abuse which targets confidentiality and data theft rather than availability.

An attack that attempts to remove or break encryption on data in transit is incorrect because that option describes cryptanalysis or attacks on confidentiality and integrity rather than a denial of service which impacts availability.

Full AWS Practitioner Certification Question