Fortinet Exam NSE6_FWB-6.4 Topic 4 Question 38 Discussion

Actual exam question for Fortinet's NSE6_FWB-6.4 exam

Question #: 38
Topic #: 4

An e-commerce web app is used by small businesses. Clients often access it from offices behind a router, where clients are on an IPv4 private network LAN. You need to protect the web application from denial of service attacks that use request floods.

What FortiWeb feature should you configure?

AEnable ''Shared IP'' and configure the separate rate limits for requests from NATted source IPs.

BConfigure FortiWeb to use ''X-Forwarded-For:'' headers to find each client's private network IP, and to block attacks using that.

CEnable SYN cookies.

DConfigure a server policy that matches requests from shared Internet connections.

Show Suggested Answer

Suggested Answer: C

by Novella at Jun 21, 2024, 10:22 PM

Limited Time Offer

25%

Off

Get Premium NSE6_FWB-6.4 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Marg

11 months ago

You know, I bet some of these candidates are going to try to outsmart the question and pick the most complex-sounding option. Classic exam strategy, but not always the best approach.

upvoted 0 times

...

Elouise

11 months ago

Ha! I bet some candidates are going to get a kick out of option A. Shared IP? Rate limits for NATted IPs? Sounds like a recipe for comedy.

upvoted 0 times

Ludivina

9 months ago

I'm not sure, but I think enabling SYN cookies could also help with preventing DoS attacks.

upvoted 0 times

...

Ezekiel

9 months ago

Yeah, I agree. I think option D might be a simpler solution.

upvoted 0 times

...

Galen

9 months ago

Option A does sound a bit complicated.

upvoted 0 times

...

Latosha

9 months ago

I'm leaning towards option B, using X-Forwarded-For headers seems like a good idea.

upvoted 0 times

...

Mirta

9 months ago

Yeah, I agree. I think option D might be a better choice.

upvoted 0 times

...

Truman

10 months ago

Option A does sound a bit complicated.

upvoted 0 times

...

Phil

11 months ago

I agree with Aretha, option A seems like the most effective solution in this scenario.

upvoted 0 times

...

Martha

11 months ago

D, for sure. Configuring a server policy to handle shared Internet connections is the most comprehensive solution to protect against those pesky request floods.

upvoted 0 times

...

Aileen

11 months ago

C is my pick. Enabling SYN cookies is a classic way to mitigate DoS attacks by verifying the client's legitimacy. Simple but effective!

upvoted 0 times

Johnson

10 months ago

Definitely, SYN cookies are a simple yet effective method to mitigate denial of service attacks.

upvoted 0 times

...

Silvana

10 months ago

It's important to have measures in place to protect against DoS attacks, and enabling SYN cookies is a solid choice.

upvoted 0 times

...

Laurel

10 months ago

I agree, SYN cookies are a reliable way to verify client legitimacy and prevent flooding.

upvoted 0 times

...

Vivan

10 months ago

C is a good choice. SYN cookies can definitely help protect against DoS attacks.

upvoted 0 times

...

Aretha

11 months ago

But option A specifically addresses protecting against request floods from NATted source IPs.

upvoted 0 times

...

Brandee

11 months ago

I disagree, I believe option C is the best choice.

upvoted 0 times

...

Adelle

11 months ago

Hmm, I think B is the way to go. Using the X-Forwarded-For headers to identify the private IP addresses and block attacks from there seems like a smart approach.

upvoted 0 times