A stadium circuit saturated during a distributed denial-of-service attack. After the attack ended, the same circuit carried normal event traffic again. Which response fits that evidence?
Select an answer to reveal the explanation.
Short Explanation
After the storm passes and the same roof keeps the rain out, you do not tear the house down. The stadium attack ended and the same circuit carried normal event traffic, so replacing that circuit is not what the evidence supports. The trap is buying bandwidth, retuning QoS, or swapping a laptop for an attack that is already over.
Full Explanation
The circuit saturated while a distributed denial-of-service attack was underway, and after the attack ended the same circuit carried normal event traffic. The attack, not the steady event-day load, was what filled the link. Leaving the circuit in place follows that evidence: a finished attack is not a reason to replace a circuit that again carries the normal load. Ordering a larger circuit, treating the attack as proof the current one is too small for event days, confuses attack volume with ordinary demand. Retuning QoS so event-day traffic outranks whatever the attack left behind assumes residual attack traffic still needs a policy change, which the recovered normal load does not show. Replacing the box-office laptop that was slow while the attack was still underway blames an endpoint for a link that was saturated by the attack. Exam caveat: saturation during an attack, followed by a return to normal on the same circuit, is evidence about the attack window and not a capacity trend. Operational check: compare utilization and loss during the attack with the same counters after the attack ended, and confirm normal event traffic fits before any circuit order is placed.