Fortinet Exam NSE6_FWB-6.4 Topic 4 Question 38 Discussion

Actual exam question for Fortinet's NSE6_FWB-6.4 exam

Question #: 38
Topic #: 4

An e-commerce web app is used by small businesses. Clients often access it from offices behind a router, where clients are on an IPv4 private network LAN. You need to protect the web application from denial of service attacks that use request floods.

What FortiWeb feature should you configure?

AEnable ''Shared IP'' and configure the separate rate limits for requests from NATted source IPs.

BConfigure FortiWeb to use ''X-Forwarded-For:'' headers to find each client's private network IP, and to block attacks using that.

CEnable SYN cookies.

DConfigure a server policy that matches requests from shared Internet connections.

Show Suggested Answer

Suggested Answer: C

by Novella at Jun 21, 2024, 10:22 PM

Limited Time Offer

25%

Off

Get Premium NSE6_FWB-6.4 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Marg

4 months ago

You know, I bet some of these candidates are going to try to outsmart the question and pick the most complex-sounding option. Classic exam strategy, but not always the best approach.

upvoted 0 times

...

Elouise

4 months ago

Ha! I bet some candidates are going to get a kick out of option A. Shared IP? Rate limits for NATted IPs? Sounds like a recipe for comedy.

upvoted 0 times

Ludivina

2 months ago

I'm not sure, but I think enabling SYN cookies could also help with preventing DoS attacks.

upvoted 0 times

...

Ezekiel

2 months ago

Yeah, I agree. I think option D might be a simpler solution.

upvoted 0 times

...

Galen

2 months ago

Option A does sound a bit complicated.

upvoted 0 times

...

Latosha

3 months ago

I'm leaning towards option B, using X-Forwarded-For headers seems like a good idea.

upvoted 0 times

...

Mirta

3 months ago

Yeah, I agree. I think option D might be a better choice.

upvoted 0 times

...

Truman

3 months ago

Option A does sound a bit complicated.

upvoted 0 times

...

Phil

4 months ago

I agree with Aretha, option A seems like the most effective solution in this scenario.

upvoted 0 times

...

Martha

4 months ago

D, for sure. Configuring a server policy to handle shared Internet connections is the most comprehensive solution to protect against those pesky request floods.

upvoted 0 times

...

Aileen

4 months ago

C is my pick. Enabling SYN cookies is a classic way to mitigate DoS attacks by verifying the client's legitimacy. Simple but effective!

upvoted 0 times

Johnson

3 months ago

Definitely, SYN cookies are a simple yet effective method to mitigate denial of service attacks.

upvoted 0 times

...

Silvana

3 months ago

It's important to have measures in place to protect against DoS attacks, and enabling SYN cookies is a solid choice.

upvoted 0 times

...

Laurel

3 months ago

I agree, SYN cookies are a reliable way to verify client legitimacy and prevent flooding.

upvoted 0 times

...

Vivan

3 months ago

C is a good choice. SYN cookies can definitely help protect against DoS attacks.

upvoted 0 times

...

Aretha

4 months ago

But option A specifically addresses protecting against request floods from NATted source IPs.

upvoted 0 times

...

Brandee

4 months ago

I disagree, I believe option C is the best choice.

upvoted 0 times

...

Adelle

4 months ago

Hmm, I think B is the way to go. Using the X-Forwarded-For headers to identify the private IP addresses and block attacks from there seems like a smart approach.

upvoted 0 times