This is clearly indicative of DoS attack where the two Test hosts are being overwhelmed with excessive traffic received causing them to become unresponsive and crash.

Cross-site scripting occurs when a web application fails to properly validate or sanitize user input, allowing attackers to inject malicious client-side code into web pages viewed by other users.
Injecting an HTML tag such as an image element that loads content from a malicious site is a common XSS technique. When the page renders, the browser processes the injected code, which can execute attacker-controlled scripts or retrieve malicious resources.

In cloud shared responsibility models, customers are always responsible for their data and how it is managed and protected, regardless of the cloud service model.

Compensating controls are alternative security measures that are implemented when the primary controls are not feasible, cost-effective, or sufficient to mitigate the risk. In this case, the organization used compensating controls to protect the legacy system from potential attacks by disabling unneeded services and placing a firewall in front of it. This reduced the attack surface and the likelihood of exploitation.

Since the budget only allows for one ISP connection, this create a single point of failure for the network connectivity.