Configure Service Protection Policies and Traffic Enforcement NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What information can be obtained from analyzing attack logs in FortiDDoS?

   • AFirmware upgrade schedule
   • BNetwork cable status
   • CAdministrator login history
   • DAttack patterns and source addresses
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A gaming company is experiencing intermittent service disruptions. The FortiDDoS attack logs show repeated SYN flood events from a single /24 subnet, each lasting 30–60 seconds, occurring every 10–15 minutes. The administrator notices that the source IPs in the logs rotate through the subnet. What should the administrator do to stop the disruption while minimizing impact on legitimate players?

   • AEnable SYN cookie protection and set a per-source threshold that triggers rate-limiting for the subnet.
   • BBlock the entire /24 subnet for 24 hours to ensure the attack stops.
   • CIncrease the global SYN threshold to allow the attack traffic to pass without triggering alarms.
   • DDisable the SYN flood protection policy and rely on the upstream firewall to handle the traffic.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A financial institution's FortiDDoS attack logs show repeated 'TCP SYN Flood' events. The administrator reviews the logs and notices that the source IPs are all from a single /24 subnet, and the events occur at the same time every day for 10 minutes. The administrator also notices that the events coincide with the daily batch job that runs on a server in that subnet. What is the most likely explanation?

   • AThe batch job is generating legitimate TCP connections that exceed the SYN threshold; the threshold should be raised or the server should be allowlisted.
   • BThe attack logs are incorrect, and the SYN flood events did not actually occur.
   • CThe SYN flood events are false positives caused by a misconfigured threshold.
   • DThe server in the /24 subnet has been compromised and is launching a SYN flood attack.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An e-commerce site is seeing false positives on its HTTPS service. The attack logs show that the 'HTTPS Request Rate' threshold is being exceeded, but the source IPs are all from a known CDN provider. The CDN is used to accelerate content delivery for legitimate customers. The administrator needs to reduce false positives without weakening protection against direct attacks. What is the best approach?

   • AIncrease the HTTPS Request Rate threshold globally to accommodate the CDN traffic.
   • BBlock the CDN's IP ranges to stop the false positives.
   • CDisable the HTTPS Request Rate threshold and rely on other thresholds like connection rate.
   • DAdd the CDN's IP ranges to an allowlist in the service protection policy so their traffic is not subject to the HTTPS Request Rate threshold.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A media company is preparing for a live streaming event. The FortiDDoS administrator needs to ensure that the streaming service is protected against UDP floods, but the current service protection policy only has TCP and HTTP enabled. What should the administrator do to protect the UDP-based streaming service?

   • AModify the existing policy to enable UDP in addition to TCP and HTTP.
   • BDisable the existing policy and create a new one with only UDP enabled.
   • CEnable UDP in the global settings without creating a policy.
   • DCreate a new service protection policy with UDP enabled and assign the appropriate protection profile.
   Reveal Solution Discussion Select an answer first