Configure Logging and Alert Mechanisms NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a common use of debug log analysis on FortiDDoS?

   • ADetermining the optimal log rotation size
   • BIdentifying the root cause of a specific issue
   • CConfiguring SMTP server settings
   • DSetting report delivery frequency
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of enabling debug logging on FortiDDoS?

   • ATo capture detailed diagnostic information for troubleshooting
   • BTo improve overall system performance
   • CTo reduce the amount of log data stored
   • DTo replace regular logging
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial institution uses FortiDDoS and needs to provide a quarterly report to the board of directors summarizing the top attacks and their impact. The report should be generated automatically and sent to the board's administrative assistant. What should the administrator configure?

   • AEnable debug logging to capture all attack data and compile the report manually.
   • BCreate a custom report with the required data sources and schedule it to run quarterly, with the assistant's email as the recipient.
   • CManually generate the report each quarter and email it to the assistant.
   • DConfigure email alerts to send a summary of attacks to the assistant daily.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial services firm uses FortiDDoS to protect its online banking portal. The security team wants to receive an email notification immediately when a SYN flood attack is detected, but they do not want to be paged for lower-severity events. The SMTP server is already configured. What should the administrator do to meet this requirement?

   • AConfigure the syslog server to forward all events to the email gateway, which then filters for SYN flood alerts.
   • BConfigure an email alert profile that triggers on the SYN flood event and set the severity threshold to 'Critical' only.
   • CEnable the default email alert settings and add the security team's email address to the global recipient list.
   • DCreate a custom email alert rule that selects the SYN flood event type and assigns the security team's email address as the recipient.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's security operations center (SOC) uses FortiAnalyzer to centralize logs from multiple Fortinet devices, including FortiDDoS. The SOC requires logs to be sent in a specific format that includes the original log message without any truncation. The FortiDDoS is currently sending logs to FortiAnalyzer, but the SOC reports that some logs are missing. What should the administrator check first?

   • AVerify that the FortiDDoS remote logging configuration uses the correct protocol and port for FortiAnalyzer.
   • BDisable debug logging to reduce the volume of logs being sent.
   • CConfigure email alerts for log forwarding failures to be notified of issues.
   • DCheck the local log retention policy to ensure logs are not being overwritten before forwarding.
   Reveal Solution Discussion Select an answer first