Purely limiting this answer to bandwidth exhaustion, there are still a few possibilities not covered by the existing answers.
You are unlikely to be the only client using the server. If the server is already receiving requests and sending responses totalling 10Mb/s, the DoS client will only need to use 90Mb/s to saturate the connection.
You don't have to completely saturate a connection to cause a DoS. As soon as you go over that 90Mb/s, real clients will have trouble getting through and the requests will start queueing up. In real terms, this will cause very slow page loads. Unless the incoming request rate slows down, this will eventually be a complete DoS.
There are also techniques for amplifying the bandwidth used by the server.
A single HTTP request usually requires the server to make several requests to other resources to satisfy the original request. These could be internal such as database queries, memcached, sphinx, NFS, etc. or external such as DNS requests, API calls and proxied requests. If the 100Mb/s restriction is on the server's connected switch, the client will not need its full 100Mb/s to DoS the server. If the 100Mb/s restriction is only on the uplink, the server could still be using more bandwidth than the client due to those DNS requests, API calls and proxied requests.
However, you didn't specify that the server is a web server.
Since the source of a UDP packet can be spoofed easily the client can make UDP requests of the server such that the response is much larger than the request and is sent somewhere other than the client. DNS responses are usually larger than requests and, if done correctly, can be 30x larger. In the case of a streaming video server, a single request to stream a 10MB video uses a few Kb/s from the client and will max out the 100Mb/s connection at the server for 8/10ths of a second. Two such requests per second would DoS the server ( and some random guy who owns the spoofed IP ).