A hosting provider is under a DNS amplification attack from a botnet that uses spoofed source IP addresses. The provider wants to block the attack traffic while ensuring legitimate DNS queries from its customers are not affected. What is the most effective configuration?

Add the DNS server's IP to the domain blocklist.

Add the spoofed source IPs to the blocklist as they are identified.

Create an ACL that permits DNS traffic only from known customer IP ranges and denies all other DNS traffic.

Configure a rate threshold to limit DNS queries per source IP.

When a domain is added to a FortiDDoS domain blocklist, what happens to traffic that matches that domain?

It is blocked from being processed

It is redirected to a quarantine server

It is allowed but with a lower priority

A multi-site enterprise uses both IPsec and GRE tunnels to connect remote offices. The FortiDDoS device is placed at the central site. The administrator has configured the IPsec tunnel endpoints in the protection profile, but traffic from the GRE tunnels is still being flagged as anomalous. The GRE tunnel endpoints are not yet configured. What is the most likely cause and the correct fix?

The GRE traffic is being blocked by an ACL; create a permit rule for the GRE protocol.

The GRE tunnel is using the same endpoints as IPsec; configure the IPsec endpoints to also cover GRE.

The GRE endpoints are missing from the protection profile; add them to the GRE tunnel endpoint list.

The IPsec endpoints are misconfigured; remove them and add the GRE endpoints instead.

A managed security provider operates a FortiDDoS device protecting multiple customers. Customer A reports a DDoS attack from a single IPv4 address that is also used as a legitimate IPsec tunnel endpoint for their remote site. Customer B reports a similar attack from a different IPv4 address that is not used for any legitimate purpose. The provider wants to block both sources while minimizing disruption. What is the best approach?

Add both sources to the IPsec tunnel endpoint list and rely on anomaly detection to filter the attack.

Blocklist Customer A's source and create an ACL to deny Customer B's source.

Create an ACL to deny Customer A's source and blocklist Customer B's source.

Blocklist both sources immediately and notify both customers of the action.

What is the primary function of an access control list (ACL) in a FortiDDoS protection profile?

To log all traffic for analysis

To permit or deny traffic based on specified criteria

To encrypt traffic between specified hosts

To rate-limit traffic from specified sources

FortinetNSE 6 - FortiDDoS Administrator

Domain 3Objective 3

Configure and Tune Protection Profiles for Anomaly Detection NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 2)

Part of the Protection and Mitigation Controls domain, which accounts for 25-35% of the NSE6-FORTIDDOS-ADMINISTRATOR exam.

12questions here

3free pages

5concepts

25-35%of the exam

Questions 6–10

6application · medium
A hosting provider is under a DNS amplification attack from a botnet that uses spoofed source IP addresses. The provider wants to block the attack traffic while ensuring legitimate DNS queries from its customers are not affected. What is the most effective configuration?
Select an answer first
7foundation · easy
When a domain is added to a FortiDDoS domain blocklist, what happens to traffic that matches that domain?
Select an answer first
8expert · hard
A multi-site enterprise uses both IPsec and GRE tunnels to connect remote offices. The FortiDDoS device is placed at the central site. The administrator has configured the IPsec tunnel endpoints in the protection profile, but traffic from the GRE tunnels is still being flagged as anomalous. The GRE tunnel endpoints are not yet configured. What is the most likely cause and the correct fix?
Select an answer first
9expert · hard
A managed security provider operates a FortiDDoS device protecting multiple customers. Customer A reports a DDoS attack from a single IPv4 address that is also used as a legitimate IPsec tunnel endpoint for their remote site. Customer B reports a similar attack from a different IPv4 address that is not used for any legitimate purpose. The provider wants to block both sources while minimizing disruption. What is the best approach?
Select an answer first
10foundation · easy
What is the primary function of an access control list (ACL) in a FortiDDoS protection profile?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTIDDOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTIDDOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.