Configure Service Protection Policies and Traffic Enforcement NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a key indicator that traffic may be a false positive rather than a genuine attack?

   • AThe traffic uses a non-standard protocol
   • BThe traffic occurs during off-peak hours
   • CThe traffic pattern matches a known legitimate spike, such as a marketing campaign
   • DThe traffic originates from a single IP address
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A social media platform is experiencing false positives on its HTTPS service. The attack logs show that the 'HTTPS Request Rate' threshold is exceeded, but the source IPs are from a mix of residential and mobile networks. The administrator analyzes the debug file and finds that the requests are for static content (images, CSS) and have a high cache-hit ratio. What is the most likely cause of the false positives?

   • AThe debug file is showing a false positive due to a misconfigured service type.
   • BThe threshold is set too low for the platform's normal traffic pattern, which includes high volumes of static content requests.
   • CThe platform is under a distributed HTTP flood attack using residential and mobile IPs.
   • DThe HTTPS Request Rate counter is measuring both HTTP and HTTPS traffic, causing an inflated count.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a common technique to reduce false positives in a service protection policy?

   • ADisabling the policy entirely
   • BChanging the administrator password
   • CIncreasing the logging level
   • DAdjusting threshold values to better match baseline traffic
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A healthcare company's FortiDDoS logs show that the 'TCP Connection Rate' threshold is being exceeded. The administrator investigates and finds that the source IPs are from a single VPN concentrator that handles remote access for employees. The VPN concentrator is legitimate and used for remote work. What should the administrator do to reduce false positives?

   • AAdd the VPN concentrator's IP range to an allowlist in the service protection policy.
   • BIncrease the TCP Connection Rate threshold to accommodate the VPN traffic.
   • CBlock the VPN concentrator's IP range to stop the false positives.
   • DDisable the TCP Connection Rate threshold entirely.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of a debug file in FortiDDoS troubleshooting?

   • ATo store backup configurations
   • BTo manage user accounts
   • CTo provide detailed diagnostic information about policy behavior during an attack
   • DTo update firmware
   Reveal Solution Discussion Select an answer first