Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Fortinet Exam NSE7_NST-7.2 Topic 5 Question 13 Discussion

Actual exam question for Fortinet's NSE7_NST-7.2 exam
Question #: 13
Topic #: 5
[All NSE7_NST-7.2 Questions]

Refer to the exhibit, which shows the output of a real-time debug.

Which statement about this output is true?

Show Suggested Answer Hide Answer
Suggested Answer: B

IKE_SA_INIT Exchange:

The IKE_SA_INIT exchange is the first step in the IKEv2 negotiation process. It is responsible for setting up the initial security association (SA) and performing Diffie-Hellman key exchange.

During this exchange, the responder may employ various measures to protect against Denial of Service (DoS) attacks, such as rate limiting and the use of puzzles to increase the computational cost for an attacker.

DoS Protection Mechanisms:

One key method involves limiting the number of half-open SAs from any single IP address or subnet.

The IKE_SA_INIT exchange can also incorporate the use of stateless cookies, which help to verify the initiator's legitimacy without requiring extensive resource allocation by the responder until the initiator is verified.


RFC 5996: Internet Key Exchange Protocol Version 2 (IKEv2) (RFC Editor).

RFC 8019: Protecting Internet Key Exchange Protocol Version 2 (IKEv2) Implementations from Distributed Denial-of-Service Attacks (IETF Datatracker).

Contribute your Thoughts:

Nikita
3 days ago
Hmm, I think option A is the correct answer. The output clearly shows the server hostname was extracted from the SNI in the client request.
upvoted 0 times
...
Jamie
6 days ago
I'm not sure, but I think option C) This web request was inspected using the rtgd-allow web filter profile could also be a possibility.
upvoted 0 times
...
Kassandra
7 days ago
I agree with Johnna, because the output shows information related to server hostname extraction.
upvoted 0 times
...
Johnna
11 days ago
I think the correct answer is A) The server hostname was extracted from the SNI in the client request, or from the CN in the server certificate.
upvoted 0 times
...

Save Cancel