Implement DDoS Protection in Different Network Topologies NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A large enterprise is deploying FortiDDoS out-of-path to protect its data center. The network team has configured SPAN from the core switch to the FortiDDoS appliance. The team wants to ensure that the appliance can detect and mitigate attacks, but they are concerned about the accuracy of the mirrored traffic. Which factor is most important to ensure accurate detection?

   • APlacing the SPAN port on the management switch
   • BConfiguring the SPAN port to capture only ingress traffic to reduce load
   • CUsing NetFlow instead of SPAN to reduce bandwidth usage
   • DEnsuring that the SPAN port is configured to capture all relevant traffic, including both ingress and egress traffic
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key operational implication of an active-active HA deployment compared to active-passive?

   • ABoth units actively process traffic, increasing overall capacity
   • BIt requires more complex licensing
   • COnly one unit processes traffic, simplifying management
   • DFailover is slower because both units must synchronize
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In an active-passive HA deployment, what is the role of the passive unit?

   • ATo monitor traffic and report to the active unit
   • BTo provide a secondary internet connection
   • CTo remain idle and take over only if the active unit fails
   • DTo share traffic load with the active unit
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A web hosting company is deploying FortiDDoS inline to protect its shared hosting platform. The company's customers include both small blogs and large e-commerce sites. The network team is concerned that a DDoS attack against one customer could saturate the FortiDDoS appliance and affect other customers. Which configuration should the team implement to mitigate this risk?

   • ADeploy the appliance out-of-path to avoid resource exhaustion
   • BUse a single global threshold for all traffic
   • CConfigure per-IP or per-customer thresholds and rate limiting
   • DDisable rate limiting to avoid dropping legitimate traffic
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In which deployment topology would FortiDDoS most likely be used to protect multiple customers' networks from volumetric attacks, often placed at the aggregation point of a provider's infrastructure?

   • AEnterprise branch
   • BData center edge
   • CService provider
   • DHome office
   Reveal Solution Discussion Select an answer first