Analyze Logs, Reports, and Traffic Data NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which FortiView feature allows an administrator to see a real-time graphical representation of attack events as they occur?

   • ATraffic Timeline view
   • BTop Talkers view
   • CAttack Events view
   • DSystem Monitor view
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An administrator is configuring the FortiDDoS dashboard for a security operations center (SOC). The SOC analysts need to quickly identify ongoing attacks, the type of mitigation being applied, and the top sources of traffic. The administrator wants to ensure that the most relevant widgets are displayed prominently. Which widgets should be placed at the top of the dashboard?

   • ATraffic Graph, Protocol Distribution, and Packet Size
   • BAttack Status, Drops, and Top Talkers
   • CSystem Health, Interface, and CPU Usage
   • DLogs, Reports, and Events
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A post-attack analysis shows that the traffic graph had a sharp spike, followed by a plateau, and then a gradual decline. The logs show that mitigation was triggered during the plateau. The analyst needs to determine if the mitigation was effective and if there were any delays in the response. What is the most accurate conclusion?

   • AThe mitigation was delayed, and the attack was already in the recovery phase when mitigation was triggered.
   • BThe mitigation was ineffective, as the traffic plateaued for a long time.
   • CThe mitigation was immediate, as it was triggered during the plateau.
   • DThe mitigation was effective, but there was a delay between the attack onset and the mitigation trigger.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of post-attack analysis in FortiDDoS?

   • ATo summarize attack characteristics and evaluate response effectiveness
   • BTo delete logs from the attack period
   • CTo configure new mitigation rules for future attacks
   • DTo identify the attacker's identity
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is using FortiView to monitor a potential DDoS attack. The FortiView display shows a large number of source IPs sending traffic to a single destination, but the traffic volume is not particularly high. The analyst suspects a low-and-slow attack. What should the analyst do to confirm this suspicion?

   • AIncrease the rate thresholds to see if the traffic volume increases.
   • BCheck the system logs for configuration changes that might have caused the traffic pattern.
   • CDisable the signature-based detection to see if the traffic pattern changes.
   • DExamine the traffic pattern over time in FortiView and correlate it with the drop counters to see if there are any anomaly-based drops.
   Reveal Solution Discussion Select an answer first