Establish Network Traffic Baselines NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   If a FortiDDoS device is generating too many false positives, what is the most appropriate threshold adjustment?

   • ADecrease the threshold values
   • BIncrease the threshold values
   • CDisable the baseline learning
   • DSwitch to manual mode
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A university campus network uses FortiDDoS to protect its internet link. The network carries a mix of student web browsing, video streaming, and administrative traffic. The administrator needs to establish a baseline that accurately reflects normal usage so that the detection thresholds do not generate excessive alerts during the first week of classes, when traffic is historically higher than the rest of the semester. What is the most appropriate approach?

   • AUse the first week of classes as the baseline learning period because it represents the highest traffic volume
   • BUse only the first week of classes and then manually lower thresholds after the semester stabilizes
   • CUse only the administrative traffic for baseline learning because it is more predictable
   • DUse a longer learning period that includes both the first week and subsequent weeks to capture the full range of normal variation
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of establishing a normal traffic baseline in FortiDDoS?

   • ATo ensure all traffic is encrypted
   • BTo block all traffic that does not match the baseline
   • CTo provide a reference for detecting deviations that may indicate an attack
   • DTo replace the need for signature-based detection
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After deploying FortiDDoS, an administrator observes that the device is generating a high number of false positives during normal business hours. The baseline was established over a two-week period that included a major product launch, which caused unusually high traffic. What is the most effective way to reduce false positives?

   • ADelete the current baseline and re-learn it during a period that excludes the product launch
   • BDisable the threshold for the business hours and rely on manual review
   • CIncrease the detection thresholds to match the higher traffic seen during the product launch
   • DKeep the current baseline and manually suppress alerts for the next month
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A cloud service provider uses FortiDDoS to protect its multi-tenant infrastructure. The traffic is highly variable, with some tenants generating bursts of traffic that are normal for them but would be anomalous for others. The provider wants to set thresholds that minimize false positives for all tenants while still detecting real attacks. What is the most effective strategy?

   • AConfigure per-tenant baselines and thresholds based on each tenant's historical traffic patterns
   • BSet thresholds to the highest peak observed across all tenants
   • CDisable thresholds and rely on anomaly detection based on statistical models
   • DUse a single global threshold based on the aggregate traffic of all tenants
   Reveal Solution Discussion Select an answer first