What should be checked regarding Denial of Service (DOS) attack statistics?

• A. A high DOS attack is normal during boot.
• B. Verify the switch has not detected a DOS attack.
• C. DOS attacks are not monitored.
• D. The switch should always detect a DOS attack.

Answer: (B)

When you look at Denial of Service statistics, the key thing to check is whether the switch has detected a DoS attack. Security features on switches continuously monitor traffic patterns and compare them to configured thresholds; a reported DoS detection means the device has identified traffic behaving abnormally and has likely taken or suggested protective actions. Verifying that there is no detection helps confirm that there isn’t an ongoing attack or a misinterpreted spike, and it prompts you to review logs and counters if something does show up.

Seeing a high DoS level during boot isn’t a reliable sign of normal operation, since boot processes aren’t expected to generate sustained DoS conditions. And DoS monitoring is a standard capability, so saying they aren’t monitored isn’t accurate. Also, the switch won’t always detect a DoS attack—detection depends on traffic patterns, threshold settings, and legitimate activity that might mimic malicious behavior—so you shouldn’t assume detection will always occur. The right action is to confirm there isn’t a detected attack and then investigate any anomalies if a detection is reported.