An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the…

The correct answer is D. An engineer should check the last hundred entries of a web server with the command sudo tail -. The best immediate step during a DDoS attack against an Apache web server is to inspect the access logs, which will show which IP addresses are making requests, their frequency, and potential patterns of abuse. As covered in the Cisco CyberOps material, "Apache logs can reveal…

Submitted by skyler.x· Mar 6, 2026Cloud Security Operations & Incident Response

Question

An engineer received a call to assist with an ongoing DDoS attack. The Apache server is being targeted, and availability is compromised. Which step should be taken to identify the origin of the threat?

Options

AAn engineer should check the list of usernames currently logged in by running the command
BAn engineer should check the server's processes by running commands ps -aux and sudo ps -a
CAn engineer should check the services on the machine by running the command service -status-
DAn engineer should check the last hundred entries of a web server with the command sudo tail -

How the community answered

(49 responses)

A
8% (4)
B
14% (7)
C
4% (2)
D
73% (36)

Explanation

The best immediate step during a DDoS attack against an Apache web server is to inspect the access logs, which will show which IP addresses are making requests, their frequency, and potential patterns of abuse. As covered in the Cisco CyberOps material, "Apache logs can reveal the IPs responsible for flooding the service with requests". The command sudo tail -100 /var/log/apache2/access.log allows quick review of recent activity.

Topics

#DDoS attack#Incident response#Apache logs#Linux commands

Community Discussion

No community discussion yet for this question.

Full 300-215 Practice