Analyze Logs, Reports, and Traffic Data NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A FortiDDoS administrator is troubleshooting an ongoing attack. The Drops widget shows a high number of 'anomaly' drops, but the traffic graph shows only a moderate increase in traffic. The logs show that the attack is using a mix of TCP SYN and UDP packets. The administrator needs to determine if the anomaly drops are due to rate-based thresholds or protocol anomalies. What is the most effective way to differentiate between these two causes?

   • AExamine the specific anomaly drop counters and correlate them with the traffic pattern and protocol mix.
   • BCheck the system logs for configuration changes that might have caused the anomaly drops.
   • CIncrease the rate thresholds and see if the anomaly drops decrease.
   • DDisable signature-based detection and see if the anomaly drops continue.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is reviewing a past DDoS incident. The logs show a spike in UDP traffic at 10:00, followed by a spike in TCP SYN traffic at 10:05. The event list shows a mitigation action at 10:06. The traffic graph shows a decline in UDP traffic after 10:06, but SYN traffic continues to rise until 10:10. What is the most coherent picture of the attack's progression?

   • AThe attack was a UDP flood that was successfully mitigated, and the SYN traffic was normal background traffic.
   • BThe attack started with a UDP flood, then shifted to a SYN flood; mitigation was partially effective, as UDP dropped but SYN continued.
   • CThe attack was a single SYN flood that began at 10:05; the UDP spike was a false positive.
   • DThe mitigation was fully effective, as it stopped the UDP traffic, but the SYN traffic was a separate attack that started later.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is preparing a post-attack report for a DDoS incident. They have access to the attack logs, traffic graphs, and mitigation event logs. They need to summarize the attack characteristics, the effectiveness of the mitigation, and the lessons learned. Which approach would provide the most comprehensive and accurate analysis?

   • AFocus on the attack logs to identify the attack vectors and ignore the traffic graphs and mitigation logs.
   • BUse the traffic graphs to show the impact and the mitigation logs to show the response, but ignore the attack logs.
   • CCorrelate the attack logs with the traffic graphs to identify the attack vectors and their impact, and use the mitigation event logs to assess the response timing and effectiveness.
   • DUse the mitigation event logs to show the response and the attack logs to show the attack, but ignore the traffic graphs.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A FortiDDoS administrator is analyzing a report after a DDoS attack. The traffic graph shows a gradual increase in traffic over 30 minutes, a plateau for 10 minutes, then a sharp decline to normal levels. The logs show mitigation actions were triggered during the plateau. Which attack phases are represented in this graph?

   • AOnset, mitigation, and recovery only
   • BPeak, mitigation, and recovery only
   • COnset, peak, and recovery only
   • DOnset, peak, mitigation, and recovery
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   During which phase of a DDoS attack does traffic return to normal levels after mitigation actions have taken effect?

   • ARecovery
   • BMitigation
   • CPeak
   • DOnset
   Reveal Solution Discussion Select an answer first