350-201 Question 14
Select 4An organization has detected unusual traffic patterns indicating a Distributed Denial of Service (DDoS) attack targeting their public-facing web server. As a cybersecurity analyst, which actions should you take as part of the incident response playbook to mitigate the attack and protect the organization's resources?
- A
Enable rate limiting on the affected server to control the traffic volume.
- B
Immediately shut down the affected web server to stop the attack.
- C
Contact the Internet Service Provider (ISP) to implement traffic filtering or blackholing.
- D
Deploy a Web Application Firewall (WAF) to filter malicious traffic targeting the web server.
- E
Monitor and analyze incoming traffic patterns to identify the source of the attack.
- F
Disable all network connections to isolate the server from the public internet.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
A DDoS attack overwhelms the target server with excessive traffic. The playbook for mitigating such an attack involves minimizing the impact on legitimate users while addressing the malicious traffic. Steps like enabling rate limiting, involving the ISP for upstream filtering, using a WAF, and monitoring traffic are proactive and effective measures. Shutting down the server or isolating it completely should only be considered as a last resort when all other measures fail.
- A. Correct.
Enabling rate limiting helps control the volume of requests to the server, reducing the impact of the DDoS attack while maintaining legitimate traffic access.
- B. Incorrect.
Shutting down the affected server is not recommended as it disrupts legitimate user access and does not address the root cause of the attack.
- C. Correct.
Contacting the ISP for traffic filtering or blackholing can mitigate the attack upstream by blocking malicious traffic before it reaches the organization’s network.
- D. Correct.
Deploying a Web Application Firewall (WAF) filters out malicious traffic, adding an additional layer of protection for the web server.
- E. Correct.
Monitoring and analyzing traffic allows the organization to identify attack patterns and potentially trace the source of the malicious activity.
- F. Incorrect.
Disabling all network connections completely isolates the server but also prevents legitimate users from accessing it, which is not ideal unless absolutely necessary.