Analyze Logs, Reports, and Traffic Data NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a DDoS attack timeline, which phase is characterized by the attacker launching the initial flood of traffic?

   • AMitigation
   • BPeak
   • CRecovery
   • DOnset
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is examining a traffic graph that shows a sudden spike in ICMP echo requests, followed by a spike in TCP SYN packets. The drop counters show a high number of 'rate-based' drops. What is the most likely interpretation of this data?

   • AA single-vector attack is occurring, with signature-based drops indicating a known attack pattern.
   • BNormal traffic is occurring, with rate-based drops due to legitimate high-volume traffic.
   • CA multi-vector attack is occurring, with rate-based drops indicating that thresholds are being exceeded.
   • DA protocol anomaly is occurring, with anomaly-based drops indicating malformed packets.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A post-attack report shows that the traffic graph had a sharp spike, followed by a plateau, and then a gradual decline. The logs show that mitigation was triggered during the plateau. What does this pattern indicate about the attack and the response?

   • AThe attack reached its peak during the plateau, and mitigation was effective in gradually reducing the traffic.
   • BThe attack was in the recovery phase during the plateau, and mitigation was not needed.
   • CThe attack was in the onset phase during the plateau, and mitigation prevented it from reaching its peak.
   • DThe attack was in the mitigation phase during the plateau, and the decline was due to the attack ending naturally.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When reviewing statistics graphs, which pattern is most indicative of a volumetric DDoS attack?

   • AA periodic fluctuation that matches business hours
   • BA consistent, low-level traffic pattern with no variation
   • CA sudden, sharp increase in traffic volume followed by a plateau
   • DA gradual, steady increase in traffic over several days
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is reviewing a DDoS incident that occurred over a weekend. The logs show that the attack started at 02:00 and ended at 05:00. The traffic graph shows a spike at 02:00, a plateau from 02:30 to 04:30, and a decline to normal at 05:00. The event list shows mitigation actions at 02:15, 03:00, and 04:00. The analyst needs to determine if the mitigation was effective and if there were any gaps in the response. What is the most accurate assessment?

   • AThe mitigation was fully effective, as the traffic returned to normal by 05:00.
   • BThe mitigation was effective, as the traffic declined after the last mitigation action, but there was a gap between the attack onset and the first mitigation action.
   • CThe mitigation was ineffective, as the traffic plateaued for two hours despite multiple mitigation actions.
   • DThe mitigation was delayed, as the first action was at 02:15, but the attack was already at its peak.
   Reveal Solution Discussion Select an answer first