Case Studies in Cybersecurity Response Planningintermediate
Compare a distributed denial-of-service (DDoS) attack with ransomware in terms of primary security impact and one suitable response action for each.
Answer
A DDoS attack primarily threatens availability by flooding a service with traffic from multiple sources; traffic filtering, diversion, mitigation services, and ISP coordination may help. Ransomware commonly threatens availability and may also threaten confidentiality if data is stolen; isolate affected systems, investigate entry and spread, check clean backups, and restore only after threat control.
Explanation
### The concept
A distributed denial-of-service (DDoS) attack uses traffic from multiple sources to overwhelm a target network, server, or service. Its direct objective is usually to make a service unavailable, so response often focuses on filtering or diverting traffic and coordinating with service providers. Ransomware is malicious software that locks or encrypts data and demands payment. It may also involve data theft, so responders must assess both operational disruption and confidentiality. Isolating affected systems can limit ransomware spread, while recovery requires trusted backups and verification.
### What a good answer covers
- DDoS primarily affects availability through excessive traffic.
- Ransomware locks or encrypts systems and may expose data.
- DDoS response can include filtering, traffic diversion, and provider coordination.
- Ransomware response includes isolation, investigation, threat removal, and verified recovery.
### Terms
- **Availability**: Access to systems or information when required.
- **Traffic filtering**: Allowing or blocking network traffic according to rules.
### Remember
Match the response to the mechanism: manage flood traffic for DDoS, contain and remove malicious code for ransomware.
Related Questions
- Which plan component most directly tells responders who may approve an external breach notification?(intermediate)
- Which activity most clearly belongs to a Security Operations Center (SOC) rather than being the primary responsibility of a Computer Security Incident Response Team (CSIRT)?(basic)
- Which tool is most directly associated in the course material with collecting and correlating logs for continuous security monitoring?(intermediate)
- Which statement best distinguishes a worm from a virus?(basic)
- A server records a successful login by an authorized employee during normal working hours. Based on the course distinction, what is this most clearly?(basic)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free