First Step to Mitigate DDoS Attack
While working as an intern for a small business, you have been tasked with managing the company's web server. The server is being bombarded with requests, and the company's website is intermittently going offline. You suspect that this could be a Distributed Denial of Service (DDoS) attack. As an ethical hacker, which of the following steps would be your first course of action to mitigate the issue?
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests knowledge of incident response priorities during a volumetric attack, specifically highlighting the trap of choosing internal fixes like bandwidth increases over upstream provider assistance.
When facing a suspected Distributed Denial of Service (DDoS) attack, the primary objective is to mitigate traffic volume before it overwhelms local infrastructure. This question establishes that engaging the ISP is the most effective initial mitigation strategy for large-scale attacks.
Candidates often select increasing server bandwidth because it seems like a direct solution to high traffic, failing to recognize that DDoS traffic can far exceed any reasonable bandwidth upgrade.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
In the event of a suspected DDoS attack, contacting your Internet Service Provider (ISP) is the correct first course of action. ISPs have access to upstream network resources and can implement traffic scrubbing or blackhole routing at the edge of their network, which is more effective than trying to handle the load on-premise. Since the attack is likely volumetric, the ISP is best positioned to filter malicious packets before they consume the company's limited bandwidth.Why the Other Options Are Wrong
Installing newer server software (B) addresses vulnerabilities but does not stop a flood of requests. Implementing IP whitelisting (C) is impractical for a public web server as it would block legitimate users and is difficult to manage dynamically during an active attack. Increasing bandwidth (D) is a temporary band-aid; attackers can simply scale their botnets to overwhelm even increased capacity, making it an ineffective standalone mitigation.Community Comment Notes
Community consensus strongly supports option A, with multiple users noting that ISPs possess specific tools to detect and mitigate DDoS attacks before traffic reaches the customer's network. Some learners questioned why bandwidth increase wasn't the answer, but the prevailing view is that upstream intervention is superior for volumetric attacks.Exam Strategy
Always prioritize actions that leverage external expertise and infrastructure when dealing with large-scale network attacks like DDoS. Remember that internal fixes are often insufficient against distributed traffic floods.
Frequently Asked Questions
Why is increasing bandwidth not the best first step?
Attackers can easily scale their botnets to overwhelm any bandwidth increase. ISPs can scrub traffic upstream, which is more efficient.
Can I use IP whitelisting to stop a DDoS attack?
Whitelisting is impractical for public websites as it blocks legitimate users and cannot handle the dynamic nature of DDoS sources.