When a SOC team, like the one Ray is part of, provides additional bandwidth to network devices and increases the capacity of servers in response to a DoS/DDoS attack, they are implementing a strategy known as ‘absorbing the attack’. This approach involves scaling up resources to handle the increased load without disrupting normal services. Here’s how it works:

Increase Bandwidth: By increasing the bandwidth, the network can handle more traffic, which is essential when under a DoS/DDoS attack, as these attacks often flood the network with excessive traffic to overwhelm it.

Enhance Server Capacity: Similarly, increasing server capacity allows the servers to handle more requests simultaneously. This is crucial during an attack to maintain service availability.

Maintain Service Availability: The goal of this strategy is to keep services running and available to legitimate users, even when under attack.

Monitor and Analyze: While absorbing the attack, it’s important to monitor network traffic and analyze the attack patterns, which can help in future prevention and mitigation strategies.

References: This answer is aligned with the best practices for DoS/DDoS attack response as outlined in EC-Council’s Certified SOC Analyst (CSA) training and certification program1234.

Please note that while I strive to provide accurate information, it’s always best to consult the latest EC-Council SOC Analyst documents and learning resources for the most current and detailed guidance.