Implement DDoS Protection in Different Network Topologies NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which placement consideration is most important when deciding whether to deploy FortiDDoS at a central aggregation point versus distributed across multiple network segments?

   • AColor of the device
   • BScalability
   • CManagement interface speed
   • DFirmware version
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which method is used to send traffic to FortiDDoS in an out-of-path deployment?

   • ATraffic mirroring or SPAN
   • BVPN tunneling
   • CDNS redirection
   • DDirect routing
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large e-commerce company is deploying FortiDDoS in an HA pair to protect its online store. The company expects a significant increase in traffic during the holiday season and wants to ensure that the HA pair can handle the load. The network team is considering whether to use active-passive or active-active HA. The company also wants to minimize the risk of a failover causing disruption. Which HA configuration should the company choose?

   • AActive-active HA with load balancing and state synchronization
   • BActive-active HA without state synchronization to reduce overhead
   • CActive-passive HA with the standby unit in the same data center
   • DActive-passive HA with the standby unit in a different data center
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A managed security service provider (MSSP) is deploying FortiDDoS to protect multiple customers' internet-facing services. The MSSP wants to use a single FortiDDoS appliance to protect multiple customers, but each customer has different traffic profiles and protection requirements. The MSSP also wants to ensure that a DDoS attack against one customer does not affect the protection of other customers. Which deployment topology best meets these requirements?

   • ADeploy FortiDDoS inline but use the same baseline for all customers
   • BDeploy FortiDDoS inline at the provider's edge, and configure separate virtual domains (VDOMs) for each customer
   • CDeploy FortiDDoS out-of-path and use a single global policy for all customers
   • DDeploy a separate FortiDDoS appliance for each customer
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A regional bank is deploying FortiDDoS to protect its internet-facing data center. The bank's compliance team requires that all traffic to the web servers be inspected for anomalies before it reaches the servers, and the security team wants to block malicious traffic in real time without relying on upstream scrubbing. The network team is concerned about adding latency to the user-facing applications. Which deployment mode and placement best meet these requirements?

   • AInline deployment at the data center edge, directly in the path between the internet router and the server farm
   • BInline deployment on the server farm's internal VLAN, inspecting only east-west traffic between servers
   • COut-of-path deployment at the internet router, using NetFlow data to detect and manually block attacks
   • DOut-of-path deployment using SPAN from the core switch to a FortiDDoS appliance that sends mitigation commands to the router
   Reveal Solution Discussion Select an answer first