After a DDoS attack, a security team is preparing a post-attack report. They need to summarize the attack characteristics, the effectiveness of the mitigation, and lessons learned. Which combination of FortiDDoS data sources should they use to gather this information?

Attack logs, traffic graphs, and mitigation event logs

FortiView real-time data and current dashboard widgets

Email alerts and syslog messages

System logs and configuration backups

An analyst is using FortiView to investigate a potential attack. They see a large number of source IPs sending traffic to a single destination IP, and the traffic is primarily UDP. The analyst wants to determine if this is a DDoS attack and identify the attack phase. What should they do next?

Check the Reports widget to see historical attack data.

Check the Drops widget to see if there are any rate-based drops and correlate with the traffic pattern.

Check the System Health widget to see if the device is overloaded.

Check the Configuration widget to see if the thresholds are set correctly.

FortinetNSE 6 - FortiDDoS Administrator

Domain 4Objective 2

Analyze Logs, Reports, and Traffic Data NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 4)

Part of the Monitoring, Logging, and Analysis domain, which accounts for 10-20% of the NSE6-FORTIDDOS-ADMINISTRATOR exam.

26questions here

6free pages

7concepts

10-20%of the exam

Questions 16–20

16application · medium
After a DDoS attack, a security team is preparing a post-attack report. They need to summarize the attack characteristics, the effectiveness of the mitigation, and lessons learned. Which combination of FortiDDoS data sources should they use to gather this information?
Select an answer first
17foundation · easy
Which type of drop is triggered when traffic exceeds a configured threshold, such as a maximum packets-per-second rate?
Select an answer first
18foundation · easy
In FortiView, which view would an administrator use to see which source IP addresses are generating the most traffic in real time?
Select an answer first
19foundation · easy
On the FortiDDoS dashboard, which widget would an administrator use to quickly see the current throughput and packet rate on the protected network?
Select an answer first
20application · medium
An analyst is using FortiView to investigate a potential attack. They see a large number of source IPs sending traffic to a single destination IP, and the traffic is primarily UDP. The analyst wants to determine if this is a DDoS attack and identify the attack phase. What should they do next?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTIDDOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTIDDOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Analyze Logs, Reports, and Traffic Data NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 4)

Questions 16–20

After a DDoS attack, a security team is preparing a post-attack report. They need to summarize the attack characteristics, the effectiveness of the mitigation, and lessons learned. Which combination of FortiDDoS data sources should they use to gather this information?

Which type of drop is triggered when traffic exceeds a configured threshold, such as a maximum packets-per-second rate?

In FortiView, which view would an administrator use to see which source IP addresses are generating the most traffic in real time?

On the FortiDDoS dashboard, which widget would an administrator use to quickly see the current throughput and packet rate on the protected network?

An analyst is using FortiView to investigate a potential attack. They see a large number of source IPs sending traffic to a single destination IP, and the traffic is primarily UDP. The analyst wants to determine if this is a DDoS attack and identify the attack phase. What should they do next?

Keep studying — Monitoring, Logging, and Analysis