An incident responder must mitigate a DDoS attack on a company web server. Which step from the playbook must the responder apply first to counteract this threat effectively?

Question

Options

• AConduct a comprehensive log analysis.
• BGather and preserve evidence for legal purposes.
• CIsolate and disconnect affected servers.
• DImplement rate limiting and traffic filtering rules.

• A
  5% (1)
• B
  18% (4)
• C
  5% (1)
• D
  73% (16)

Explanation

Implementing rate limiting and traffic filtering (D) is the correct first response because a DDoS attack works by overwhelming your server with traffic - stopping that flood at the network/firewall layer is the only action that immediately reduces harm to the affected system while it's still under attack.

Why the distractors are wrong:

• A (Log analysis) is valuable for understanding the attack, but analyzing logs while the server is being hammered doesn't stop the damage - it's a post-stabilization step.
• B (Preserve evidence) is a legal/forensic concern that comes after you've contained the threat; evidence collection during active attack is premature and delays mitigation.
• C (Isolate/disconnect servers) sounds decisive but is counterproductive for a web server - taking it offline means the attacker wins by achieving the same result as the DDoS itself (unavailability).

Memory tip: Think "stop the bleeding before the autopsy." In DDoS response, traffic filtering is your tourniquet - everything else (logging, evidence, analysis) happens once the flood is controlled. The order is: Filter → Analyze → Document.

No community discussion yet for this question.