CS0-003 Incident Response and Management Practice Question
An organization is experiencing a distributed denial-of-service (DDoS) attack targeting its web servers. The incident response team is implementing containment strategies. Which TWO actions are appropriate for short-term containment of a DDoS attack? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rerouting traffic through a DDoS mitigation service or scrubbing center
Short-term containment for DDoS includes blocking attack traffic at the network perimeter and diverting traffic via a scrubbing center. Patching servers does not stop the attack, and rebuilding is recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Rerouting traffic through a DDoS mitigation service or scrubbing center
Why this is correct
Rerouting traffic through a DDoS mitigation service or scrubbing center is the most effective response because these services employ specialized filtering, rate limiting, and behavioral analysis to distinguish legitimate user requests from malicious traffic, forwarding only clean traffic to the origin. This approach is well-suited for both volumetric floods and application-layer attacks, and it can be activated quickly by updating DNS or BGP to redirect traffic.
- ✗
Disabling the accounts of the attackers
Why it's wrong here
Disabling attacker accounts is ineffective against a DDoS attack because these attacks are typically launched from botnets—thousands of compromised systems—or use spoofed source IP addresses, rather than relying on authenticated user sessions. Since the malicious traffic never establishes a valid session on the web server, there are no legitimate accounts to disable, so the action does nothing to reduce the packet flood or connection exhaustion.
- ✗
Applying a security patch to the web server software
Why it's wrong here
Applying a security patch to the web server software addresses specific code vulnerabilities, but DDoS attacks exploit resource limitations such as bandwidth, connection table capacity, or CPU/processing power, not a software flaw that can be patched. A volumetric or protocol-based attack will overwhelm the server regardless of its patch level, and patching often requires a restart, which could cause additional downtime during an active attack.
- ✗
Rebuilding the web servers from clean images
Why it's wrong here
Rebuilding web servers from clean images is a recovery step intended to remove persistent malware or attacker backdoors, but a DDoS attack does not indicate a compromise of the server itself; it is an external flood of traffic overwhelming resources. Rebuilding is time-consuming and would needlessly take the server offline, and it does nothing to stop the incoming attack traffic, making it a poor immediate containment measure.
- ✓
Blocking the attacking IP addresses at the firewall
Why this is correct
Blocking the attacking IP addresses at the firewall can be an effective immediate action when the attack uses non-spoofed, stable source IPs, as it drops malicious traffic before it reaches the server and reduces load. However, this method is limited if the source IPs are spoofed or the attack is widely distributed across a botnet, so it should be combined with other mitigation techniques, but it remains a valid first line of defense.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Containment
Containment is the incident response phase where security teams isolate a compromised system or network to prevent the threat from spreading further while preserving evidence.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.