1.8 Create and Apply DoS Protection Profiles NETWORK-SECURITY-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of the 'random early drop' action in a DoS protection profile?

   • ATo drop all packets from the source IP immediately
   • BTo randomly select a source IP to block for a period
   • CTo randomly forward packets to different interfaces
   • DTo randomly drop packets before the threshold is reached to prevent congestion
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An administrator has configured a DoS protection profile with SYN flood protection set to 'random early drop' and applied it to the untrust zone. After a suspected attack, the administrator wants to confirm that the profile is working correctly. Which log or report should the administrator examine to see the specific packets that were dropped by the DoS protection?

   • AThe traffic log, which shows the action taken on each packet, including drops.
   • BThe system log, which records firewall restarts and configuration changes.
   • CThe threat log, which shows detected malware and vulnerability exploits.
   • DThe configuration audit log, which shows changes to the firewall configuration.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What should you check to confirm that a DoS protection profile is active on a zone?

   • AThe zone's configuration shows the profile is attached
   • BThe security policy allows all traffic
   • CThe firewall's CPU usage is below 50%
   • DThe interface has a public IP address
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large e-commerce company is preparing for a major sales event. They expect a significant increase in legitimate traffic to their web servers. The security team has a DoS protection profile with SYN flood protection set to 'random early drop' and a threshold based on the current baseline. To avoid dropping legitimate traffic during the event, what should the administrator do?

   • AKeep the current threshold and action, as the profile will adapt to the traffic increase.
   • BDisable the DoS protection profile during the event to ensure no legitimate traffic is dropped.
   • CChange the SYN flood action to 'alert' to avoid dropping any traffic during the event.
   • DIncrease the SYN flood threshold to accommodate the expected traffic increase.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When creating a DoS protection profile, which of the following settings can be configured for SYN flood protection?

   • AThe list of allowed source IP addresses for SYN traffic
   • BThe encryption algorithm for SYN packets
   • CThe maximum number of concurrent sessions per source IP
   • DThe threshold for the rate of SYN packets per second
   Reveal Solution Discussion Select an answer first