Ray is a SOC analyst in a company named Queens Tech. One Day, Queens Tech is affected by a DoS/DDoS attack. For the containment of this incident, Ray and his team are trying to provide additional bandwidth to the network devices and increasing the capacity of the servers. What is Ray and his team doing?

The actions of providing additional bandwidth and increasing server capacity are characteristic of an absorption strategy for mitigating DoS/DDoS attacks. Instead of trying to block or filter the malicious traffic, this approach aims to scale the infrastructure's resources to a point where they can handle, or "absorb," the attack traffic volume without a significant impact on service availability for legitimate users. This is a common, albeit often expensive, strategy used by large-scale service providers and DDoS mitigation services to withstand volumetric attacks.

A: Blocking the attacks would involve actively identifying and dropping malicious packets using firewalls or other filtering mechanisms, which is not what is described. B: Diverting the traffic involves rerouting it, often to a third-party scrubbing center for cleaning before it reaches the target network. C: Degrading services is a strategy to preserve critical functions by shutting down non-essential ones, which is the opposite of increasing overall capacity.

1. Douligeris, C., & Mitrokotsa, A. (2004). DDoS attacks and defense mechanisms: classification and state-of-the-art. Computer Networks, 44(5), 643-666. Section 4.2.2 discusses "Provisioning of resources" as a defense mechanism. https://doi.org/10.1016/j.comnet.2003.10.003

2. NIST Special Publication 800-61 Rev. 2, "Computer Security Incident Handling Guide," Section 3.4.3, "Containment." Discusses various containment strategies, and increasing capacity aligns with mitigating the impact of the incident.