NSE4 Security Profiles Practice Question
An administrator runs 'diagnose ips anomaly list' and sees the following output: List of anomaly events: ID: 1, Type: tcp_syn_flood, Status: triggered, Count: 1500, Threshold: 1000 What does this indicate?
⚠ Common exam trap
Many candidates confuse a triggered anomaly with a permanent block action or misinterpret the count as a single packet, when in fact the output clearly shows a rate-based threshold exceedance indicating an ongoing flood attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FortiGate is experiencing a TCP SYN flood attack and has triggered rate-based detection.
The output from 'diagnose ips anomaly list' shows a tcp_syn_flood anomaly with a count of 1500 exceeding the threshold of 1000, and the status is 'triggered'. This indicates that the FortiGate's IPS anomaly sensor has detected a rate-based anomaly — specifically, the number of TCP SYN packets received per second has surpassed the configured threshold, which is a classic sign of a TCP SYN flood attack. The FortiGate has triggered its rate-based detection mechanism, which can then take configured actions such as alerting or blocking, confirming option C as correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IPS anomaly sensor is configured to block all TCP traffic.
Why it's wrong here
The IPS anomaly sensor does not work as a global filter for all TCP traffic; it is designed to detect specific protocol anomalies and rate-based attacks, such as TCP SYN floods, by comparing packet rates against learned or configured thresholds. Blocking every TCP packet would require a firewall policy or a custom IPS signature, not an anomaly sensor, and doing so would break all TCP-based services rather than responding to an attack. The output explicitly references 'tcp_syn_flood,' which is a targeted anomaly, so the sensor is not configured to drop the entire TCP protocol suite.
- ✗
The FortiGate has detected a single TCP SYN packet and is logging it.
Why it's wrong here
The diagnostic output shows a count of 1500 SYN packets, which is well above the configured threshold, so this is not a single packet being logged. An anomaly event is only generated when the monitored rate or count crosses the threshold—so a single SYN packet would never trigger this event. Additionally, the output indicates the anomaly was 'triggered,' meaning the FortiGate has already applied its configured action (e.g., blocking or alerting) in response to the flood, not merely recorded one packet.
- ✓
The FortiGate is experiencing a TCP SYN flood attack and has triggered rate-based detection.
Why this is correct
The output displays an anomaly event of type 'tcp_syn_flood' in the triggered state, which means the FortiGate has detected that the number of incompleted TCP SYN packets has exceeded the configured threshold for the anomaly sensor. This is rate-based detection because the sensor continuously monitors the rate of SYN packets and compares it against a threshold; when the rate shoots up, the anomaly is considered triggered and the configured action (such as dropping subsequent packets or sending an alert) is executed. Therefore, the FortiGate is correctly interpreting a TCP SYN flood attack targeting itself or a protected host.
- ✗
The FortiGate is performing a TCP SYN flood attack.
Why it's wrong here
This option confuses the victim with the attacker. The FortiGate is running 'diagnose ips anomaly list' to inspect traffic that it is receiving or forwarding, and the tcp_syn_flood anomaly indicates that an external source is sending an excessive number of SYN packets—the FortiGate is on the receiving side of that attack. Performing a SYN flood would require the FortiGate to actively generate a high volume of spoofed SYN packets, which is not a feature of IPS anomaly detection; the anomaly sensor is purely a detection and mitigation tool, not a packet generation mechanism.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.