Which action occurs during the traceback phase of the six-phase approach to service provider security?

During the traceback phase of the six-phase approach to service provider security, the action that occurs is tracing the attack flows from the attacked sections of the network toward the network edges. This phase entails identifying the source of the attack by analyzing the path that the attack traffic has taken through the network.