Question
An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack. Which of the following logs should the team review first?
- A. CDN
- B. Vulnerability scanner
- C. DNS Correct
- D. Web server
Explanation
When users in every location suddenly cannot reach any external SaaS resource, the shared dependency is name resolution, and DNS is a frequent DDoS target (query floods and DNS amplification). The DNS logs show the flood of queries, failed resolutions and the sources involved, so they are the first place to confirm the attack's scope. CDN and web server logs cover the organization's own published content, not users' outbound access to external services, and a vulnerability scanner log does not record attack traffic.
