Which of the following should be performed FIRST in the aftermath of a denial-of-service attack?

A.
Restore servers from backup media stored offsite

B.
Conduct an assessment to determine system status

C.
Perform an impact analysis of the outage

D.
Isolate the screened subnet

Explanation:

An assessment should be conducted to determine whether any permanent damage occurred and
the overall system status. It is not necessary at this point to rebuild any servers. An impact
analysis of the outage or isolating the demilitarized zone (DMZ) or screen subnet will not provide
any immediate benefit.