Fortinet Exam NSE8_811 Topic 1 Question 9 Discussion

Actual exam question for Fortinet's NSE8_811 exam

Question #: 9
Topic #: 1

Exhibit

Click the Exhibit button.

The exhibit shows the configuration of a service protection profile (SPP) in a FortiDDoS device.

Which two statements are true about the traffic matching being inspected by this SPP? (Choose two.)

ATraffic that does match any spp policy will not be inspection by this spp.

BFortiDDos will not send a SYNACK if a SYN packet is coming from an IP address that is not the legtimate IP (LIP) address table.

CFortiDooS will start dropping packets as soon as the traffic executed the configured maintain threshold.

DSYN packets with payloads will be drooped.

Show Suggested Answer

Suggested Answer: A, D

https://help.fortinet.com/fddos/4-3-0/FortiDDoS/Configuring_SPP_settings.htm

SYN cookie---Sends a SYN/ACK with a cookie value in the TCP sequence field. If it receives an ACK back with the right cookie, an RST/ACK packet is sent and the IP address is added to the legitimate IP address table. If the client then retries, it succeeds in making a TCP connection.

So apparently, the very first SYN/ACK with a cookie value is sent when the IP address is not in the legitimate IP address table yet.

by Cory at May 04, 2022, 07:28 PM

Limited Time Offer

25%

Off

Get Premium NSE8_811 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!