During peak season, a travel company's online booking portal is flooded with traffic from thousands of compromised hosts and becomes unreachable for customers. No data was accessed or altered. Which control BEST addresses the security property that was affected?
Select an answer to reveal the explanation.
Short Explanation
When the doors to your shop are jammed by a mob that isn't buying anything, real customers can't get in. That's an availability hit, plain and simple. So you want something that soaks up the flood before it reaches you, not a control that guards secrets or detects tampering.
Full Explanation
A distributed denial-of-service attack targets availability: legitimate users cannot reach a service even though its data stays intact and private. The effective response is capacity and filtering placed upstream of the target. A scrubbing service, typically delivered by a cloud or carrier provider, absorbs volumetric floods across a large distributed network, discards attack traffic, and forwards clean requests to the origin, so the portal's own bandwidth and servers are not exhausted. Field-level encryption protects confidentiality of stored reservations, which the scenario says were never touched, and it does nothing to keep the service reachable. File integrity monitoring detects unauthorized changes to server files; it supports integrity and incident detection but cannot stop packets from saturating links. Multifactor authentication strengthens identity verification at sign-in, yet attack traffic in a flood rarely needs to authenticate at all, and the extra step adds load rather than removing it. Exam caveat: match the control to the CIA leg that was harmed; a stem stating no data was read or altered points squarely at availability. Operational check: confirm the scrubbing service's diversion method (DNS or routing), test failover before peak season, and verify that the origin accepts traffic only from the provider so attackers cannot bypass it by hitting the origin address directly.