350-201 Question 15
Select 3You are a cybersecurity analyst investigating a Distributed Denial of Service (DDoS) attack targeting your organization's web servers. According to the playbook, after confirming the attack and identifying the malicious IP addresses, what should your next steps include?
- A
Block the identified IP addresses at the firewall or router level.
- B
Notify the upstream Internet Service Provider (ISP) about the malicious traffic.
- C
Capture and analyze packets to identify the root cause of the attack.
- D
Immediately shut down the affected web servers to stop the attack.
- E
Deploy a Web Application Firewall (WAF) to filter malicious traffic.
Show answer and explanation
Correct answers: A, B, E
Explanation
When responding to a DDoS attack, the primary focus should be on mitigating the impact of the attack on your organization's systems and services, as outlined in the playbook. Blocking malicious IPs and notifying the ISP can significantly reduce the immediate threat. Deploying a WAF adds an additional layer of defense by filtering harmful traffic. While activities such as packet analysis are valuable, they are generally conducted after mitigation steps to identify long-term solutions. Shutting down the servers should only be a last resort, as it disrupts services entirely without addressing the root cause.
- A. Correct.
Blocking the identified malicious IP addresses at the firewall or router level is a standard step to mitigate the attack and reduce the impact on your network.
- B. Correct.
Notifying the ISP is crucial as they can help mitigate the attack upstream, potentially reducing the volume of malicious traffic before it reaches your network.
- C. Incorrect.
While packet capture and analysis can provide valuable insights, it is not a primary mitigation step during an active DDoS attack, as the goal is to quickly reduce the impact rather than investigate the root cause at this stage.
- D. Incorrect.
Shutting down the affected web servers is not recommended unless absolutely necessary, as it results in complete loss of service and does not address the root problem of malicious traffic.
- E. Correct.
Deploying a Web Application Firewall (WAF) can help filter out malicious traffic and protect your web servers from further attacks.