NSE4 · Question #275
An administrator is examining the attack logs and notices the following entry: device_id=FG100A3907508962 log_id=18432 subtype=anomaly type=ips timestamp=1270017358 pri=alert itime=1270017893…
The correct answer is B. This attack was caught by the DoS sensor "protect-servers". This log entry indicates a Denial of Service (DoS) anomaly detected by an IPS sensor named 'protect-servers', where a TCP source session threshold was exceeded.
Question
An administrator is examining the attack logs and notices the following entry:
device_id=FG100A3907508962 log_id=18432 subtype=anomaly type=ips timestamp=1270017358 pri=alert itime=1270017893 severity=critical src=192.168.1.52 dst=64.64.64.64 src_int=internal serial=0 status=clear_session proto=6 service=http vd=root count=1 src_port=35094 dst_port=80 attack_id=100663402 sensor=protect- servers tcp_src_session, 2 > threshold 1" policyid=0 carrier_ep=N/A profile=N/A dst_int=N/A user=N/A group=N/A Based solely upon this log message, which of the following statements is correct?
Options
- AThis attack was blocked by the HTTP protocol decoder.
- BThis attack was caught by the DoS sensor "protect-servers".
- CThis attack was launched against the FortiGate unit itself rather than a host behind the FortiGate
- DThe number of concurrent connections to destination IP address 64.64.64.64 has exceeded the
How the community answered
(19 responses)- B84% (16)
- C11% (2)
- D5% (1)
Why each option
This log entry indicates a Denial of Service (DoS) anomaly detected by an IPS sensor named 'protect-servers', where a TCP source session threshold was exceeded.
While the service is HTTP, the log indicates `subtype=anomaly type=ips`, meaning it was caught by a generic IPS anomaly detection mechanism, not specifically by an HTTP protocol decoder.
The log explicitly states `subtype=anomaly`, `type=ips`, and `sensor=protect-servers`, clearly identifying that an anomaly (which includes DoS attacks) was detected by the specified IPS sensor. The message `tcp_src_session, 2 > threshold 1` further indicates a session-based anomaly, characteristic of DoS detection.
The destination `dst=64.64.64.64` and `dst_port=80` clearly indicate that the attack targeted a web server on the internet, not the FortiGate unit itself.
The `tcp_src_session, 2 > threshold 1` indicates that a source (192.168.1.52) has exceeded its allowed concurrent sessions, not necessarily that the destination IP (64.64.64.64) has exceeded its total concurrent connections.
Concept tested: FortiGate IPS/DoS log analysis
Source: https://docs.fortinet.com/document/fortigate/7.4.0/log-message-reference/724392/ips-messages
Topics
Community Discussion
No community discussion yet for this question.