Too many variables uncounted for in the second scenario. For example, do we know what is going to be targeted and through what method it would be attacked? How

Too many variables uncounted for in the second scenario. For example, do we know what is going to be targeted and through what method it would be attacked? How many legitimate users need web access to this critical service? Assuming that knowledge, there's plenty that could be done if we have forewarning. Take those neighborhoods offline at the ISP level. Alternately, block the zombie IP ranges via firewall at the receiving end. I think the real danger is that we won't have such forewarning, and in the slim chance we did we won't have that crucial knowledge(what specifically is the target and attack vector?).