Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Fortinet Exam NSE7_NST-7.2 Topic 3 Question 17 Discussion

Actual exam question for Fortinet's NSE7_NST-7.2 exam
Question #: 17
Topic #: 3
[All NSE7_NST-7.2 Questions]

Which exchange lakes care of DoS protection in IKEv2?

Show Suggested Answer Hide Answer
Suggested Answer: B

IKE_SA_INIT Exchange:

The IKE_SA_INIT exchange is the first step in the IKEv2 negotiation process. It is responsible for setting up the initial security association (SA) and performing Diffie-Hellman key exchange.

During this exchange, the responder may employ various measures to protect against Denial of Service (DoS) attacks, such as rate limiting and the use of puzzles to increase the computational cost for an attacker.

DoS Protection Mechanisms:

One key method involves limiting the number of half-open SAs from any single IP address or subnet.

The IKE_SA_INIT exchange can also incorporate the use of stateless cookies, which help to verify the initiator's legitimacy without requiring extensive resource allocation by the responder until the initiator is verified.


RFC 5996: Internet Key Exchange Protocol Version 2 (IKEv2) (RFC Editor).

RFC 8019: Protecting Internet Key Exchange Protocol Version 2 (IKEv2) Implementations from Distributed Denial-of-Service Attacks (IETF Datatracker).

Contribute your Thoughts:

Steffanie
2 months ago
B) IKE_SA_INIT all the way! It's like the bouncer at the door, making sure only the cool kids get in.
upvoted 0 times
...
Leota
2 months ago
A) IKE_Req_INIT? What is this, a joke? That's like asking a lion to protect a herd of sheep.
upvoted 0 times
Gearldine
28 days ago
D) I always get confused between IKE_SA_INIT and Create_CHILD_SA.
upvoted 0 times
...
Billye
1 months ago
C) No, it's actually IKE_SA_INIT that takes care of DoS protection.
upvoted 0 times
...
Corrie
1 months ago
A) Really? I thought it was IKE_Auth that handled that.
upvoted 0 times
...
Laurel
1 months ago
C) IKE_Auth also plays a role in ensuring DoS protection in IKEv2.
upvoted 0 times
...
Delsie
1 months ago
B) IKE_SA_INIT is the one responsible for DoS protection in IKEv2.
upvoted 0 times
...
Allene
2 months ago
B) IKE_SA_INIT is the one responsible for DoS protection in IKEv2.
upvoted 0 times
...
...
Oren
2 months ago
I agree with Annamae, IKE_SA_INIT makes sense for DoS protection.
upvoted 0 times
...
Audria
2 months ago
I'm not sure, but I think it might be C) IKE_Auth for DoS protection.
upvoted 0 times
...
Sage
3 months ago
D) Create_CHILD_SA? Really? That's like trying to put out a fire with gasoline. Not a chance.
upvoted 0 times
...
Tiffiny
3 months ago
C) IKE_Auth seems like the logical choice here. I mean, who doesn't love a good authentication phase, am I right?
upvoted 0 times
...
Lucina
3 months ago
B) IKE_SA_INIT, of course! That's where the magic happens to protect against DoS attacks. Can't believe anyone would think otherwise.
upvoted 0 times
Filiberto
2 months ago
User 3: So, IKE_SA_INIT is the key for DoS protection in IKEv2.
upvoted 0 times
...
Johnetta
2 months ago
User 2: Definitely, that's where the initial security association is established.
upvoted 0 times
...
Eugene
2 months ago
User 1: I think it's IKE_SA_INIT too, it's crucial for DoS protection.
upvoted 0 times
...
...
Annamae
3 months ago
I think the answer is B) IKE_SA_INIT.
upvoted 0 times
...

Save Cancel
a