FCNSP · Question #33
An administrator is examining the attack logs and notices the following entry: device_id=FG100A3907508962 log_id=18432 subtype=anomaly type=ips timestamp=1270017358 pri=alert itime=1270017893 severity
The correct answer is B. This attack was caught by the DoS sensor "protect-servers".. See the full explanation below for the reasoning.
Question
An administrator is examining the attack logs and notices the following entry:
device_id=FG100A3907508962 log_id=18432 subtype=anomaly type=ips timestamp=1270017358 pri=alert itime=1270017893 severity=critical src=192.168.1.52 dst=64.64.64.64 src_int=internal serial=0 status=clear_session proto=6 service=http vd=root count=1 src_port=35094 dst_port=80 attack_id=100663402 sensor=protect-servers 1" policyid=0 carrier_ep=N/A profile=N/A dst_int=N/A user=N/A group=N/A Based solely upon this log message, which of the following statements is correct?
Options
- AThis attack was blocked by the HTTP protocol decoder.
- BThis attack was caught by the DoS sensor "protect-servers".
- CThis attack was launched against the FortiGate unit itself rather than a host behind the FortiGate unit.
- DThe number of concurrent connections to destination IP address 64.64.64.64 has exceeded the configured
How the community answered
(29 responses)- A3% (1)
- B83% (24)
- C10% (3)
- D3% (1)
Community Discussion
No community discussion yet for this question.