While working as an intern for a small business, you have been tasked with managing the company's web server. The server is being bombarded with requests, and the company's website is intermittently…

Contacting the ISP is the first course of action because ISPs possess the network infrastructure, specialized DDoS mitigation services (like scrubbing centers), and expertise to detect, filter, and reroute malicious traffic closer to its source, protecting the customer's network edge. This offloads the attack from the company's limited resources and allows for a more comprehensive, network-level defense against the overwhelming volume of requests.

Installing newer server software primarily addresses security vulnerabilities or improves performance, but it does not provide an immediate or effective defense against a volumetric DDoS attack targeting network resources.

Implementing IP address whitelisting would block all legitimate public users, effectively taking the website offline rather than mitigating the DDoS attack while maintaining service availability.

Increasing the server's bandwidth might absorb a slightly larger attack, but it is a temporary and often insufficient measure against a large-scale DDoS, as attackers can typically generate traffic far exceeding even increased capacities, leading to continued saturation.