QuestionQ12

Incident Response Techniques

An engineer receives a call to help with an active DDoS attack. The Apache server is the target, and its availability is affected. Which action should be performed to determine the threat’s origin?

  • A An engineer should check the list of usernames currently logged in by running the command $ who | cut ""d' "˜ -f1| sort | uniq
  • B An engineer should check the server's processes by running commands ps -aux and sudo ps -a.
  • C An engineer should check the services on the machine by running the command service -status-all.
  • D An engineer should check the last hundred entries of a web server with the command sudo tail -100 /var/log/apache2/access.log.
Explanation

Apache access logs record incoming HTTP requests, including the originating client IP address. Inspecting the most recent access-log entries helps identify the sources responsible for abnormal request traffic.

Community Discussion

No comments yet. Be the first to start the discussion!