Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Fortinet Exam NSE7_NST-7.2 Topic 3 Question 21 Discussion

Actual exam question for Fortinet's NSE7_NST-7.2 exam
Question #: 21
Topic #: 3
[All NSE7_NST-7.2 Questions]

Which exchange lakes care of DoS protection in IKEv2?

Show Suggested Answer Hide Answer
Suggested Answer: B

IKE_SA_INIT Exchange:

The IKE_SA_INIT exchange is the first step in the IKEv2 negotiation process. It is responsible for setting up the initial security association (SA) and performing Diffie-Hellman key exchange.

During this exchange, the responder may employ various measures to protect against Denial of Service (DoS) attacks, such as rate limiting and the use of puzzles to increase the computational cost for an attacker.

DoS Protection Mechanisms:

One key method involves limiting the number of half-open SAs from any single IP address or subnet.

The IKE_SA_INIT exchange can also incorporate the use of stateless cookies, which help to verify the initiator's legitimacy without requiring extensive resource allocation by the responder until the initiator is verified.


RFC 5996: Internet Key Exchange Protocol Version 2 (IKEv2) (RFC Editor).

RFC 8019: Protecting Internet Key Exchange Protocol Version 2 (IKEv2) Implementations from Distributed Denial-of-Service Attacks (IETF Datatracker).

Contribute your Thoughts:

Micheal
13 days ago
B) IKE_SA_INIT, because that's where the magic happens, baby! Protecting against DoS like a boss.
upvoted 0 times
...
Sonia
15 days ago
IKE_SA_INIT all the way! Gotta keep those DoS attackers at bay, am I right? *winks*
upvoted 0 times
Kasandra
2 days ago
A) IKE_SA_INIT is the one that takes care of DoS protection in IKEv2.
upvoted 0 times
...
...
Mel
17 days ago
Hmm, I think it's IKE_SA_INIT. Sounds like the logical place to handle DoS protection in IKEv2.
upvoted 0 times
...
Quentin
21 days ago
I'm pretty sure it's IKE_SA_INIT. Gotta protect against those pesky DoS attacks, you know?
upvoted 0 times
Willie
3 days ago
Yes, that's correct. It's important to have that protection in place to prevent any disruptions from DoS attacks.
upvoted 0 times
...
Ruthann
6 days ago
I think you're right, IKE_SA_INIT is the one that takes care of DoS protection in IKEv2.
upvoted 0 times
...
...
Miles
29 days ago
Actually, I believe it's D) Create_CHILD_SA because it establishes the secure channel for data exchange.
upvoted 0 times
...
Diego
30 days ago
IKE_SA_INIT, of course! That's where the DoS protection happens, right? No way it's anything else.
upvoted 0 times
Shawn
18 days ago
Yes, you're right! IKE_SA_INIT is responsible for DoS protection in IKEv2.
upvoted 0 times
...
...
Rory
1 months ago
I agree with Douglass, IKE_SA_INIT is responsible for DoS protection in IKEv2.
upvoted 0 times
...
Douglass
1 months ago
I think the answer is B) IKE_SA_INIT.
upvoted 0 times
...

Save Cancel