StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Intrusion prevention

Practice question 311 of 440 · hard

An IPS entry uses rate-mode periodical, rate-count 100, rate-duration 60 and rate-track src-ip. One source reaches the threshold within 60 seconds. Which interpretation fits?

Choose the single best answer.

  1. A.The rate applies only to archive decompression
  2. B.The duration means a 60-day signature hold
  3. C.The threshold is evaluated for that source within the duration
  4. D.Counts from every source are necessarily combined globally
Show the answer and explanation

✓ Correct answer

  • The threshold is evaluated for that source within the duration

The configured periodical source tracking evaluates incidents per source over the duration. Global aggregation, decompression and hold time are different settings.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.