A FortiDDoS device is deployed in a network with a mix of direct and proxied traffic. The administrator has configured global thresholds for SYN packets. During a legitimate spike in traffic from proxied clients, the SYN threshold is exceeded, causing false positives. The administrator suspects that the proxy IP list is not correctly configured. What is the most likely cause?

The global SYN threshold is set too high

The interface role is set to 'trusted' for the proxy interface

The proxy IP list does not include all proxy IPs, so FortiDDoS counts SYN packets from each proxy as separate sources

A company uses a load balancer that modifies the X-Forwarded-For header. The security team wants FortiDDoS to correctly identify the original client IP even when the load balancer is in the path. What is the best practice?

Configure FortiDDoS to use the source IP of the load balancer as the client IP

Enable cloud signaling to correct the header

Add the load balancer's IP to the proxy IP list and ensure the header is not overwritten

Disable the X-Forwarded-For header on the load balancer

What is the default behavior of global thresholds on FortiDDoS when a threshold is exceeded?

The device restarts to clear the traffic

The device automatically blocks all traffic

The device sends an alert but does not take any action

The device triggers a mitigation action such as dropping or rate-limiting the offending traffic

A FortiDDoS device is deployed in a network where the legitimate traffic volume varies significantly throughout the day. The administrator wants to avoid false positives during peak hours while still protecting against attacks during off-peak hours. What is the best approach?

Set thresholds to the off-peak value permanently

Set thresholds to the peak traffic value permanently

Disable global thresholds and rely on per-IP thresholds

Enable auto-learning to adjust thresholds dynamically based on traffic patterns

An organization wants to ensure that FortiDDoS can receive real-time threat intelligence from FortiGuard and also share attack data with a SIEM system. What should be configured?

Enable cloud signaling and add the SIEM IP to the proxy IP list

Configure syslog forwarding and enable global threshold auto-tuning

Enable cloud signaling for FortiGuard and configure syslog forwarding to the SIEM

Enable bypass mode and configure syslog forwarding

FortinetNSE 6 - FortiDDoS Administrator

Domain 3Objective 1

Implement Global Protection Settings NSE6-FORTIDDOS-ADMINISTRATOR Practice Questions (Page 1)

Part of the Protection and Mitigation Controls domain, which accounts for 25-35% of the NSE6-FORTIDDOS-ADMINISTRATOR exam.

25questions here

5free pages

4concepts

25-35%of the exam

Questions 1–5

1expert · hard
A FortiDDoS device is deployed in a network with a mix of direct and proxied traffic. The administrator has configured global thresholds for SYN packets. During a legitimate spike in traffic from proxied clients, the SYN threshold is exceeded, causing false positives. The administrator suspects that the proxy IP list is not correctly configured. What is the most likely cause?
Select an answer first
2application · medium
A company uses a load balancer that modifies the X-Forwarded-For header. The security team wants FortiDDoS to correctly identify the original client IP even when the load balancer is in the path. What is the best practice?
Select an answer first
3foundation · medium
What is the default behavior of global thresholds on FortiDDoS when a threshold is exceeded?
Select an answer first
4application · medium
A FortiDDoS device is deployed in a network where the legitimate traffic volume varies significantly throughout the day. The administrator wants to avoid false positives during peak hours while still protecting against attacks during off-peak hours. What is the best approach?
Select an answer first
5application · medium
An organization wants to ensure that FortiDDoS can receive real-time threat intelligence from FortiGuard and also share attack data with a SIEM system. What should be configured?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTIDDOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTIDDOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.