Explain DDoS Prevention and Mitigation Methods NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does anomaly detection identify a potential DDoS attack?

   • ABy blocking all traffic from IP addresses that have previously attacked
   • BBy matching traffic against a database of known attack signatures
   • CBy comparing current traffic patterns to a baseline of normal behavior
   • DBy limiting the rate of traffic from each source IP address
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which type of DDoS attack is characterized by overwhelming the target with a massive volume of traffic, such as a UDP flood, to saturate bandwidth?

   • AAmplification attack
   • BApplication-layer attack
   • CProtocol attack
   • DVolumetric attack
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a primary limitation of rate limiting compared to anomaly detection?

   • ARate limiting cannot detect distributed attacks from many sources
   • BRate limiting may block legitimate users who exceed the threshold
   • CRate limiting requires a baseline of normal traffic to function
   • DRate limiting cannot be applied to application-layer traffic
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial services company experiences periodic traffic spikes from legitimate marketing campaigns, but also occasional short bursts of UDP floods. The security team needs a mitigation strategy that will not block legitimate marketing traffic during spikes, yet will still contain UDP flood bursts. Which approach best satisfies these requirements?

   • AUse signature-based detection to block UDP floods without any rate limiting
   • BApply a permanent blocklist to all UDP source IPs
   • CEnable anomaly detection to establish a baseline, then apply rate limiting only when deviations exceed a threshold
   • DDeploy a static rate limit on all inbound UDP traffic
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's web server is overwhelmed by a flood of incomplete TCP handshakes, exhausting its connection table. The attack does not rely on high bandwidth. Which type of attack is this, and which mitigation is most appropriate?

   • ADNS amplification; use allowlisting
   • BHTTP flood; use blocklisting
   • CSYN flood; use rate limiting on new connection attempts
   • DUDP flood; use signature-based detection
   Reveal Solution Discussion Select an answer first