Configure Service Protection Policies and Traffic Enforcement NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A retail company's FortiDDoS logs show that the 'ICMP Echo Request Rate' threshold is being exceeded. The administrator investigates and finds that the source IPs are all from a single monitoring service that performs health checks every minute. The monitoring service is legitimate and used for uptime monitoring. What should the administrator do?

   • ADisable the ICMP Echo Request Rate threshold entirely.
   • BAdd the monitoring service's IP range to an allowlist in the service protection policy.
   • CBlock the monitoring service's IP range to stop the false positives.
   • DIncrease the ICMP Echo Request Rate threshold to accommodate the monitoring traffic.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a configurable setting within a FortiDDoS service protection policy?

   • ALog retention period
   • BAdministrator password
   • CService type
   • DFirmware version
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How can attack logs be used to evaluate the effectiveness of a protection policy?

   • ABy verifying the firmware version
   • BBy reviewing whether the policy's enforcement actions were triggered and how much attack traffic was blocked
   • CBy checking the device's CPU usage
   • DBy reviewing the administrator's configuration changes
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A bank's FortiDDoS attack logs show a high volume of DNS queries from a single source IP, but the queries are all for the bank's own domain. The administrator suspects a DNS amplification attack, but the source IP is a known internal recursive resolver. The logs also show that the 'DNS Query Rate' threshold was exceeded. What is the most likely explanation?

   • AThe internal resolver is generating legitimate recursive queries that exceed the threshold; the threshold should be raised or the resolver should be allowlisted.
   • BThe DNS Query Rate threshold is correctly configured, and the resolver should be blocked to stop the attack.
   • CThe attack logs are incorrect, and the threshold was not actually exceeded.
   • DThe internal resolver has been compromised and is being used in a DNS amplification attack.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A government agency is troubleshooting a suspected DDoS attack. The FortiDDoS debug file shows that the 'UDP Packet Rate' is high, but the 'UDP Bit Rate' is low. The source IPs are all from a single /16 subnet. The administrator needs to determine if this is an attack or a legitimate traffic pattern. What is the most likely conclusion?

   • AThis is a UDP flood attack with small packets, designed to exhaust the device's packet processing capacity.
   • BThis is legitimate traffic from a large organization using VoIP or streaming services.
   • CThe debug file is showing a false positive due to a misconfigured threshold.
   • DThis is a DNS amplification attack, which typically uses small queries to generate large responses.
   Reveal Solution Discussion Select an answer first