Configure Logging and Alert Mechanisms NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A retail company's security team receives alert emails from FortiDDoS, but they find the default subject line uninformative. They want the subject to include the attack type and the source IP address so they can quickly triage alerts. What should the administrator configure?

   • AConfigure the syslog server to send formatted alerts to the email gateway.
   • BEnable debug logging and include the debug output in the email subject.
   • CCustomize the email alert template to include variables for attack type and source IP in the subject line.
   • DUse the default email subject and rely on the body to provide details.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A FortiDDoS administrator is troubleshooting a false positive where legitimate traffic is being blocked. The issue is intermittent and only occurs under specific conditions. The administrator needs to capture detailed diagnostic information to identify the root cause. What should the administrator do?

   • ARestart the FortiDDoS device to clear any temporary state and observe if the issue resolves.
   • BIncrease the log retention period to 180 days and review historical logs for similar events.
   • CEnable debug logging for the relevant module and reproduce the issue while capturing the logs.
   • DConfigure email alerts for all blocked traffic events and wait for the next occurrence.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A gaming company uses FortiDDoS to protect its online services. The operations team needs a daily report showing the top 5 attack types and the total bandwidth consumed by attacks. They also want a weekly report with a detailed breakdown of attack sources. The administrator wants to automate both reports to be delivered to different teams. What should the administrator do?

   • AConfigure syslog forwarding to send all logs to an external reporting tool that generates both reports.
   • BCreate one custom report that includes all required data and schedule it daily, then have the weekly team filter the data.
   • CUse the default report template and schedule it to run daily, then manually email the weekly breakdown.
   • DCreate two custom reports with different templates and schedules, and assign different recipients for each.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A FortiDDoS administrator enabled debug logging to troubleshoot a specific issue. After collecting the logs, the administrator notices that the debug logs contain a large amount of information that is not relevant to the issue. What should the administrator do to focus the analysis?

   • AIncrease the debug logging level to capture even more details.
   • BFilter the debug logs by module or event type to isolate the relevant entries.
   • CDelete the debug logs and start over with a more specific configuration.
   • DDisable debug logging and rely on standard logs for analysis.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A healthcare organization must retain logs for at least one year for regulatory compliance. They use FortiDDoS and have limited local storage. They also need to send real-time alerts to their security team via email. The administrator is considering options to meet both requirements without purchasing additional hardware. What should the administrator do?

   • AEnable debug logging to capture more details and store logs locally for one year.
   • BConfigure email alerts to include full log details and rely on email as the primary log storage.
   • CConfigure FortiDDoS to forward logs to a remote syslog server or FortiAnalyzer for long-term storage, and set local retention to a shorter period.
   • DIncrease local log retention to one year and disable remote logging to save bandwidth.
   Reveal Solution Discussion Select an answer first