Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Fortinet Exam NSE7_NST-7.2 Topic 3 Question 19 Discussion

Actual exam question for Fortinet's NSE7_NST-7.2 exam
Question #: 19
Topic #: 3
[All NSE7_NST-7.2 Questions]

Which exchange lakes care of DoS protection in IKEv2?

Show Suggested Answer Hide Answer
Suggested Answer: B

IKE_SA_INIT Exchange:

The IKE_SA_INIT exchange is the first step in the IKEv2 negotiation process. It is responsible for setting up the initial security association (SA) and performing Diffie-Hellman key exchange.

During this exchange, the responder may employ various measures to protect against Denial of Service (DoS) attacks, such as rate limiting and the use of puzzles to increase the computational cost for an attacker.

DoS Protection Mechanisms:

One key method involves limiting the number of half-open SAs from any single IP address or subnet.

The IKE_SA_INIT exchange can also incorporate the use of stateless cookies, which help to verify the initiator's legitimacy without requiring extensive resource allocation by the responder until the initiator is verified.


RFC 5996: Internet Key Exchange Protocol Version 2 (IKEv2) (RFC Editor).

RFC 8019: Protecting Internet Key Exchange Protocol Version 2 (IKEv2) Implementations from Distributed Denial-of-Service Attacks (IETF Datatracker).

Contribute your Thoughts:

Catarina
2 months ago
Hold on, let me consult my crystal ball... Ah yes, the answer is B. IKE_SA_INIT, where the DoS protection is as secure as a locked safe.
upvoted 0 times
Shanda
1 months ago
Yes, that's correct. It's the exchange that takes care of DoS protection in IKEv2.
upvoted 0 times
...
Yen
1 months ago
I think the answer is B) IKE_SA_INIT.
upvoted 0 times
...
...
Verdell
2 months ago
Actually, I believe the correct answer is D) Create_CHILD_SA because it establishes the secure channel for data exchange.
upvoted 0 times
...
Yong
2 months ago
I agree with Thora, IKE_SA_INIT handles DoS protection in IKEv2.
upvoted 0 times
...
Thora
2 months ago
I think the answer is B) IKE_SA_INIT.
upvoted 0 times
...
James
2 months ago
Haha, good one! Clearly, the answer is IKE_Auth. I mean, who doesn't love a little authentication with their DoS protection?
upvoted 0 times
...
Mattie
2 months ago
Wait, I thought it was Create_CHILD_SA. Isn't that where the real security magic happens?
upvoted 0 times
Hildred
27 days ago
Oh, I see. So IKE_SA_INIT is the one responsible for DoS protection. Thanks for clarifying!
upvoted 0 times
...
Sharika
1 months ago
Create_CHILD_SA is for setting up the secure channel, but DoS protection is actually handled by IKE_SA_INIT.
upvoted 0 times
...
Ricarda
1 months ago
D) Create_CHILD_SA
upvoted 0 times
...
Skye
1 months ago
C) IKE_Auth
upvoted 0 times
...
Elza
1 months ago
B) IKE_SA_INIT
upvoted 0 times
...
Emiko
2 months ago
A) IKE_Req_INIT
upvoted 0 times
...
...
Marci
2 months ago
I'm pretty sure it's IKE_Req_INIT. Doesn't that handle the initial request and set up the DoS protection?
upvoted 0 times
Antonio
1 months ago
D) Create_CHILD_SA is used to establish a child SA, not for DoS protection.
upvoted 0 times
...
Antione
2 months ago
C) IKE_Auth is responsible for authentication, not DoS protection.
upvoted 0 times
...
Margurite
2 months ago
B) No, it's actually IKE_SA_INIT that handles the initial exchange and sets up DoS protection.
upvoted 0 times
...
Herman
2 months ago
A) IKE_Req_INIT takes care of DoS protection in IKEv2.
upvoted 0 times
...
...
Derick
2 months ago
IKE_SA_INIT, of course! That's where the Diffie-Hellman key exchange happens, and DoS protection is crucial there.
upvoted 0 times
Adaline
1 months ago
B) IKE_SA_INIT
upvoted 0 times
...
Willis
1 months ago
Yes, IKE_SA_INIT is where the Diffie-Hellman key exchange takes place.
upvoted 0 times
...
Arleen
2 months ago
A) IKE_SA_INIT
upvoted 0 times
...
...

Save Cancel