Question

A security analyst discovers that an attacker is attempting to launch a distributed denial-of-service (DDoS) attack on the company's network.

What action should the security analyst take to prevent the DDoS attack from succeeding?

answer

Shut down the server until the attacker is identified


Configure the router to limit the amount of traffic coming from the attacker's IP address


Implement a firewall to block traffic from the attacker's IP address


Add more bandwidth to the server to handle the increased traffic

Answer 1

Implement a firewall to block traffic from the attacker's IP address.

Reason: blocking known malicious IPs at the network perimeter is an immediate, standard mitigation. Shutting down the server causes unnecessary downtime; simply adding bandwidth won't stop a large DDoS; and per‑IP router rate‑limits may help in limited cases but are less effective against distributed attacks. For larger/ongoing DDoS attacks consider upstream filtering, rate limiting, scrubbing services/CDN, or contacting your ISP.