What is the starting point for investigating denial-of-service attacks?

What is the starting point for investigating denial-of-service attacks?

• A. Tracing the packets
• B. Checking server uptime
• C. Reviewing user accounts
• D. Inspecting hard drives

Answer: (A)

Beginning with network traffic analysis is essential. Tracing packets lets you see the flood in real detail—the total volume, the rate of requests, patterns over time, and which protocol or service is being abused. This data helps distinguish the type of DoS you’re facing (volumetric floods, protocol exploits, or application-layer requests) and shows whether traffic might be spoofed or coming from a botnet. With packet traces in hand, you can correlate with firewall, router, and load balancer logs to map sources, validate anomalies, and start shaping an effective mitigation plan. Starting points like checking server uptime only reveal whether the service is reachable, not how the attack operates. Reviewing user accounts might help if a legitimate user is generating unusual traffic, but DoS investigations require traffic evidence first to tell malicious activity from normal spikes. Inspecting hard drives is not relevant to network-based denial-of-service, since the issue lies in overwhelmed network or service resources, not standalone data on disk.

Beginning with network traffic analysis is essential. Tracing packets lets you see the flood in real detail—the total volume, the rate of requests, patterns over time, and which protocol or service is being abused. This data helps distinguish the type of DoS you’re facing (volumetric floods, protocol exploits, or application-layer requests) and shows whether traffic might be spoofed or coming from a botnet. With packet traces in hand, you can correlate with firewall, router, and load balancer logs to map sources, validate anomalies, and start shaping an effective mitigation plan.

Starting points like checking server uptime only reveal whether the service is reachable, not how the attack operates. Reviewing user accounts might help if a legitimate user is generating unusual traffic, but DoS investigations require traffic evidence first to tell malicious activity from normal spikes. Inspecting hard drives is not relevant to network-based denial-of-service, since the issue lies in overwhelmed network or service resources, not standalone data on disk.