A web application team notifies a SOC analyst that there are thousands of HTTP/404 events on the public-facing web server. Which of the following is the next step for the analyst to take?

Question

Options

• AInstruct the firewall engineer that a rule needs to be added to block this external server
• BEscalate the event to an incident and notify the SOC manager of the activity
• CNotify the incident response team that there is a DDoS attack occurring
• DIdentify the IP/hostname for the requests and look at the related activity

• A
  7% (3)
• B
  4% (2)
• C
  16% (7)
• D
  73% (33)

Explanation

Explanation

Before taking any action, a SOC analyst must first gather and analyze information - identifying the source IP/hostname and examining related activity will reveal whether this is a legitimate issue (like a broken link), a scanning/reconnaissance attempt, or something more serious. Jumping to conclusions without investigation is a fundamental error in security analysis; you must understand what is happening before deciding how to respond.

Why the distractors are wrong:

• A is premature - you cannot block an IP you haven't yet identified, and blocking without investigation may be unnecessary or counterproductive.
• B is premature - escalating to a full incident before determining severity skips the triage process; 404 errors alone are not automatically an incident.
• C is incorrect - HTTP 404 errors indicate "page not found" responses, not the volumetric traffic overload characteristic of a DDoS attack; assuming DDoS without evidence is a misdiagnosis.

Memory Tip

Think of the SOC analyst as a detective: you never arrest someone before investigating. Use the phrase "Investigate Before You Act" - always identify the source and analyze context first, then escalate or respond based on what the evidence actually shows.

No community discussion yet for this question.