Explain DDoS Prevention and Mitigation Methods NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A government agency runs a public-facing portal that must remain accessible to all citizens, but has been hit by repeated SYN floods from a small set of known botnet IPs. The agency cannot predict all attack sources. Which mitigation strategy is most appropriate?

   • ABlocklist the known botnet IPs and keep the service open to all other sources
   • BDisable SYN cookies to reduce processing overhead
   • CSwitch to an allowlist that only permits traffic from a pre-approved citizen registry
   • DApply a low static rate limit to all inbound SYN packets
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which statement correctly compares rate limiting and anomaly detection?

   • ARate limiting requires a signature database, while anomaly detection does not
   • BRate limiting uses fixed thresholds, while anomaly detection uses a baseline of normal behavior
   • CRate limiting is more effective against application-layer attacks, while anomaly detection is more effective against volumetric attacks
   • DRate limiting is reactive, while anomaly detection is proactive
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a primary advantage of inline mitigation?

   • AIt can filter malicious traffic in real time as it passes through the device
   • BIt does not introduce any additional latency to the traffic path
   • CIt does not require any configuration or maintenance
   • DIt can be deployed without affecting the existing network architecture
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which statement about response times is accurate when comparing inline and out-of-path mitigation?

   • AOut-of-path mitigation typically has faster response times because it does not add latency
   • BInline mitigation typically has faster response times because traffic is inspected in real time
   • CBoth have identical response times because they use the same filtering techniques
   • DResponse times depend only on the hardware, not on the deployment mode
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A telecommunications provider must filter malicious traffic in real time with minimal delay and cannot rely on external scrubbing centers. Which mitigation architecture is most appropriate?

   • AInline mitigation device placed directly in the traffic path
   • BOut-of-path mitigation using flow-based monitoring only
   • CInline mitigation with a bypass switch that is disabled during attacks
   • DOut-of-path mitigation using BGP redirect to a third-party scrubbing center
   Reveal Solution Discussion Select an answer first