GISF: GIAC Information Security Fundamentals

John is a security manager at Mariotx.Inc. He has been assigned to resolve a network-attack issue. To address the problem, he first examines critical information about the attacker's interactions with the network environment. He prepares a past-record and behavioral document of the attack to identify a direction for the solution. He then decides to act based on the prior hypothesis and takes the appropriate action against the attack. Which of the following strategies has John followed?