Fortinet Exam NSE7_NST-7.2 Topic 3 Question 21 Discussion

Actual exam question for Fortinet's NSE7_NST-7.2 exam

Question #: 21
Topic #: 3

[All NSE7_NST-7.2 Questions]

Refer to the exhibit, which shows a session table entry.

Which statement about FortiGate behavior relating to this session is true?

AFortiGate forwarded this session without any inspection.

BFortiGate is performing a security profile inspection using the CPU.

CFortiGate redirected the client to the captive portal to authenticate, so that a correct policy match could be made.

DFortiGate applied only IPS inspection to this session.

Show Suggested Answer

Suggested Answer: B

IKE_SA_INIT Exchange:

The IKE_SA_INIT exchange is the first step in the IKEv2 negotiation process. It is responsible for setting up the initial security association (SA) and performing Diffie-Hellman key exchange.

During this exchange, the responder may employ various measures to protect against Denial of Service (DoS) attacks, such as rate limiting and the use of puzzles to increase the computational cost for an attacker.

DoS Protection Mechanisms:

One key method involves limiting the number of half-open SAs from any single IP address or subnet.

The IKE_SA_INIT exchange can also incorporate the use of stateless cookies, which help to verify the initiator's legitimacy without requiring extensive resource allocation by the responder until the initiator is verified.

RFC 5996: Internet Key Exchange Protocol Version 2 (IKEv2) (RFC Editor).

RFC 8019: Protecting Internet Key Exchange Protocol Version 2 (IKEv2) Implementations from Distributed Denial-of-Service Attacks (IETF Datatracker).

by Shelton at Feb 11, 2025, 07:09 AM

Limited Time Offer

25%

Off

Get Premium NSE7_NST-7.2 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Kristin

4 days ago

I think the correct answer is B. The session table entry shows that FortiGate is performing a security profile inspection, which uses the CPU.

upvoted 0 times

...