QuestionQ12
Incident Response TechniquesAn engineer receives a call to help with an active DDoS attack. The Apache server is the target, and its availability is affected. Which action should be performed to determine the threat’s origin?
- A An engineer should check the list of usernames currently logged in by running the command $ who | cut ""d' "˜ -f1| sort | uniq
- B An engineer should check the server's processes by running commands ps -aux and sudo ps -a.
- C An engineer should check the services on the machine by running the command service -status-all.
- D An engineer should check the last hundred entries of a web server with the command sudo tail -100 /var/log/apache2/access.log.
Community Discussion