Sophia, an incident handler at a cloud hosting provider, is investigating reports of intermittent web...

The described symptoms—numerous incomplete TCP connections consuming server resources—are characteristic of a SYN flood attack, a denial-of-service technique targeting the transport layer. In such attacks, attackers send SYN packets without completing the TCP handshake, leaving servers overwhelmed with half-open connections.

ECIH network incident handling guidance emphasizes rapid identification and containment of DoS conditions to preserve service availability. By configuring the router to validate connection requests (for example, using SYN cookies or proxy validation), illegitimate handshake attempts are filtered before reaching the server.

Option A involves payload inspection, which is irrelevant here. Option B relates to authentication attacks, which require completed connections. Option D is a detection activity, not mitigation.

Therefore, the purpose of Sophia’s action was to block SYN flood attempts, making Option C correct.