View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 21.

A FortiWeb administrator wants to publish a protected web application through FortiWeb in reverse proxy mode. Which object represents the client-facing address that users connect to?

1. Virtual server
2. Server pool member
3. Signature exception
4. IP reputation category

Correct Answer: 1. Virtual server

Explanation:

In a reverse proxy deployment, a virtual server represents the client-facing service that receives incoming connections for a protected application. Clients connect to the virtual server address, and FortiWeb then applies the relevant security policy and forwards approved traffic toward the configured backend server pool. The virtual server is therefore part of the application publishing path rather than the definition of an individual backend host. Server pools identify protected application servers, while signature exceptions and IP reputation settings influence security handling. Correct virtual server configuration is important because it determines where FortiWeb listens for traffic and how protected application requests enter the security inspection process.

Question 22.

What is the MAIN purpose of configuring multiple members in a FortiWeb server pool?

1. Create multiple administrator accounts
2. Provide backend redundancy and load distribution
3. Increase the number of attack signatures
4. Replace TLS certificates automatically

Correct Answer: 2. Provide backend redundancy and load distribution

Explanation:

A server pool can contain multiple backend application servers so FortiWeb can distribute incoming requests and provide resilience when one member becomes unavailable. Load-balancing logic determines how new requests are distributed, while health checks help identify servers that should temporarily stop receiving traffic. This design can improve both performance and application availability. Server pool members are not related to administrator identities, signature count, or certificate replacement. A well-designed pool should include health checks that accurately reflect application availability rather than merely testing whether a server responds at the network layer.

Question 23.

A FortiWeb health check confirms that a backend server responds to TCP connections, but the application itself returns errors. What is the BEST improvement?

1. Disable health checks
2. Use only ICMP tests
3. Configure an application-aware health check that validates the expected web response
4. Increase the web attack signature severity

Correct Answer: 3. Configure an application-aware health check that validates the expected web response

Explanation:

A basic TCP health check may confirm that the server is reachable and that a listening port is open, but it does not necessarily prove that the web application is functioning correctly. An application-aware HTTP or HTTPS health check can request a specific resource and verify an expected status, content string, or other response condition. This helps FortiWeb distinguish a functioning application from a server that is technically online but returning errors. Accurate health checks improve failover and load-balancing decisions. Disabling health checks would make server availability harder to determine, while attack signature severity has no direct relationship to backend application health.

Question 24.

A FortiWeb administrator wants requests from the same client to continue reaching the same backend server. Which feature is MOST relevant?

1. Attack logging
2. Signature inheritance
3. IP reputation
4. Session persistence**

Correct Answer: 4. Session persistence

Explanation:

Session persistence, sometimes called stickiness, helps ensure that requests belonging to the same user or session continue to reach the same backend server. This may be required by applications that maintain session state locally instead of storing it in a shared backend service. Without persistence, requests could move between different servers and disrupt the user session. The exact persistence method should match the application architecture and available FortiWeb features. Attack logging and IP reputation serve security-monitoring purposes, while signature settings detect application-layer attacks. Persistence is specifically an application delivery function that influences backend server selection.

Question 25.

A protected application uses HTTPS between clients and FortiWeb, but the administrator wants FortiWeb to forward traffic to the backend servers using HTTP. What is this commonly called?

1. SSL offloading
2. DNS tunneling
3. VLAN translation
4. Packet mirroring

Correct Answer: 1. SSL offloading

Explanation:

SSL or TLS offloading occurs when FortiWeb terminates the encrypted client connection, decrypts the traffic for inspection, and forwards the request to the backend using unencrypted HTTP. This can reduce cryptographic workload on application servers and simplify centralized certificate management. However, administrators should consider the security of the network segment between FortiWeb and the backend servers. If that segment is not sufficiently trusted, re-encryption may be preferable. SSL offloading is different from packet mirroring or network tunneling because FortiWeb actively participates in and terminates the application session.

Question 26.

Why might an administrator choose to re-encrypt traffic from FortiWeb to the backend server after inspection?

1. To prevent FortiWeb from seeing HTTP content
2. To protect application data on the internal network segment
3. To disable certificate validation permanently
4. To prevent load balancing

Correct Answer: 2. To protect application data on the internal network segment

Explanation:

Re-encryption maintains confidentiality between FortiWeb and the backend server after FortiWeb has inspected the client-side HTTPS request. This is useful when internal network segments are not considered fully trusted or when compliance requirements call for encryption in transit throughout the entire connection path. FortiWeb terminates the client TLS session, performs application security inspection, and then establishes a separate secure connection toward the backend. Proper certificate validation and trust configuration should be maintained. Re-encryption does not stop FortiWeb from inspecting traffic; instead, it protects the second leg of the connection.

Question 27.

A FortiWeb administrator wants to protect an application against malformed HTTP requests that violate protocol standards. Which security function is MOST appropriate?

1. Static routing
2. Server persistence
3. HTTP protocol validation
4. DNS forwarding

Correct Answer: 3. HTTP protocol validation

Explanation:

HTTP protocol validation checks requests for malformed syntax, invalid methods, abnormal headers, oversized fields, and other conditions that violate expected HTTP behavior. Attackers may intentionally send malformed requests to exploit parser differences, application weaknesses, or intermediary devices. FortiWeb can enforce protocol constraints before such requests reach the backend application. These controls should be tuned to actual application behavior because overly strict limits may block legitimate clients. Protocol validation complements attack signatures and behavioral detection by enforcing expected structure rather than matching only known malicious payloads.

Question 28.

A protected application never uses the HTTP TRACE method. What is the BEST FortiWeb policy decision?

1. Allow TRACE for every request
2. Convert TRACE to POST automatically
3. Disable all HTTP methods
4. Block TRACE if it is not required by the application**

Correct Answer: 4. Block TRACE if it is not required by the application

Explanation:

Applications should expose only the methods required for legitimate operation. If TRACE is not needed, blocking it reduces unnecessary functionality that an attacker could attempt to abuse. This follows a least-functionality principle similar to least privilege. Administrators should first understand normal application methods so necessary requests such as GET, POST, PUT, or others are not blocked accidentally. Restricting unused methods is one layer of defense and should be combined with authentication, authorization, signatures, behavioral controls, and secure application design.

Question 29.

A FortiWeb administrator wants to stop requests containing a known SQL injection pattern before they reach the application server. Which control should be enabled?

1. Web attack signatures
2. Server health checks only
3. Static routes
4. SNMP polling

Correct Answer: 1. Web attack signatures

Explanation:

Web attack signatures inspect HTTP request content for known malicious patterns associated with attacks such as SQL injection. When a request matches a configured signature, FortiWeb can block, alert, or otherwise handle the traffic according to policy. Signature-based detection is effective against known attack techniques and should be kept current. It is strongest when combined with additional controls such as machine learning, protocol validation, input constraints, and secure application coding. Health checks and routing affect availability and traffic forwarding but do not inspect application payloads for injection patterns.

Question 30.

A legitimate request is repeatedly blocked by one specific FortiWeb signature. What is the BEST administrative response?

1. Disable the entire web protection profile
2. Validate the request and create the narrowest practical exception
3. Remove all attack signatures
4. Bypass FortiWeb permanently

Correct Answer: 2. Validate the request and create the narrowest practical exception

Explanation:

When a legitimate request triggers a signature, the administrator should first verify that it is truly safe and understand which URL, parameter, or request element is causing the match. A narrowly scoped exception can then be created so the legitimate request is allowed while the signature continues protecting other application traffic. Disabling the entire protection profile or signature category may expose unrelated parts of the application to attacks. Exceptions should be documented and reviewed periodically because application behavior and threats change over time. The goal is to correct a false positive without unnecessarily weakening protection.

Question 31.

What is a key advantage of using FortiWeb machine-learning-based application protection in addition to signatures?

1. It can help identify abnormal application behavior that does not match a known signature
2. It eliminates the need for all web security controls
3. It makes backend servers unnecessary
4. It automatically fixes application source code

Correct Answer: 1. It can help identify abnormal application behavior that does not match a known signature

Explanation:

Signature-based controls focus primarily on recognized attack patterns, while machine-learning or behavioral protection can establish a model of legitimate application behavior and identify requests that significantly deviate from that model. This can help detect previously unseen or unusual attacks that do not exactly match known signatures. A learning and tuning period is important so the system understands normal URLs, parameters, methods, and request patterns. Behavioral detection does not eliminate the need for signatures, secure development, authentication, or other defenses. It provides an additional layer that can improve protection against evolving application-layer threats.

Question 32.

Why should FortiWeb machine-learning policies generally be observed and tuned before strict blocking is enabled?

1. To increase network broadcasts
2. To remove all HTTPS certificates
3. To identify legitimate application behavior and reduce false positives
4. To disable attack logging

Correct Answer: 3. To identify legitimate application behavior and reduce false positives

Explanation:

Behavioral systems require representative application traffic so they can distinguish normal requests from suspicious deviations. If strict enforcement is enabled before enough legitimate traffic has been learned, unusual but valid requests may be classified incorrectly. Administrators should monitor detections, validate application behavior, and tune the model before moving to aggressive blocking. The learning period should include normal users, important workflows, scheduled jobs, APIs, and other legitimate traffic patterns. Tuning does not weaken security; instead, it improves the accuracy of later enforcement by reducing unnecessary blocks.

Question 33.

A web application contains a login page that is targeted by automated password guessing. Which FortiWeb capability is MOST relevant?

1. Static routing
2. Session persistence only
3. Server health checking
4. Bot mitigation and rate-based controls**

Correct Answer: 4. Bot mitigation and rate-based controls

Explanation:

Automated authentication abuse may involve brute-force attacks, credential stuffing, account enumeration, or distributed bot activity. Bot mitigation can help identify automated clients, while rate controls can limit excessive requests to sensitive login endpoints. Administrators should tune thresholds carefully to avoid blocking legitimate users, especially when many clients share an address through proxies or NAT. These controls should be combined with strong application authentication, multifactor authentication where supported, account lockout strategies, and monitoring. Server health and routing do not directly address automated login abuse.

Question 34.

A FortiWeb administrator wants to restrict access to an administrative web portal so that only approved source networks can connect. Which control is MOST appropriate?

1. Access control based on source address or network
2. Disable all attack signatures
3. Use only server persistence
4. Increase request body size

Correct Answer: 1. Access control based on source address or network

Explanation:

If a sensitive administrative portal should be reachable only from approved corporate or management networks, source-based access control can reduce exposure by rejecting requests from unauthorized locations. This should complement, not replace, strong authentication and application-layer security because source addresses alone are not sufficient proof of identity. Administrators should carefully define trusted networks and account for legitimate remote-access paths. Restricting management-oriented application surfaces can significantly reduce attack opportunities compared with making them openly reachable from the internet.

Question 35.

What is the PRIMARY purpose of FortiWeb URL access rules?

1. Control how requests to specific application paths are handled
2. Configure physical switch ports
3. Assign addresses using DHCP
4. Replace backend authentication systems

Correct Answer: 1. Control how requests to specific application paths are handled

Explanation:

URL access rules allow administrators to apply decisions to particular application paths or resources. Depending on configuration, specific URLs may be allowed, denied, restricted, redirected, or protected differently. This can be useful for administrative pages, sensitive application areas, legacy endpoints, or resources that should be available only to certain users or networks. URL access control is most effective when administrators understand the application’s path structure and normal request flow. It complements authentication, signatures, protocol validation, and other security mechanisms rather than replacing them.

Question 36.

An administrator wants to prevent sensitive information such as payment card data from appearing in web responses. Which FortiWeb function is MOST relevant?

1. Server persistence
2. Data leak prevention
3. Static routing
4. DNS caching

Correct Answer: 2. Data leak prevention

Explanation:

Data leak prevention capabilities can inspect application responses for sensitive information patterns and apply configured actions when protected data is detected. This can help reduce accidental exposure of payment information, personal identifiers, or other confidential content through web applications. Administrators should tune detection carefully to minimize false positives and understand exactly where sensitive information is legitimately expected. DLP is an additional protective layer and should be combined with proper application authorization, secure coding, database access controls, and data minimization. Routing and persistence features do not inspect responses for sensitive-data leakage.

Question 37.

A FortiWeb administrator wants to protect a file upload page from potentially dangerous content. What should be configured?

1. File upload restrictions and appropriate malware-related inspection
2. Only a larger server pool
3. A less restrictive TLS configuration
4. Disabled HTTP inspection

Correct Answer: 1. File upload restrictions and appropriate malware-related inspection

Explanation:

File uploads create risk because attackers may attempt to submit malware, scripts, executable content, oversized files, or formats the application does not require. FortiWeb can enforce restrictions based on file characteristics and can integrate inspection capabilities where supported. Administrators should understand which file types and sizes are legitimate and block unnecessary content. The application itself should also store uploaded files securely and avoid executing them directly. Disabling HTTP inspection would remove important visibility, while server pool changes do not address malicious upload content.

Question 38.

What is the purpose of FortiWeb IP reputation filtering?

1. Create backend server pools
2. Identify and control traffic from known or suspicious source IP addresses
3. Configure SSL certificates
4. Replace application authorization

Correct Answer: 2. Identify and control traffic from known or suspicious source IP addresses

Explanation:

IP reputation adds intelligence about the historical behavior or classification of source addresses. FortiWeb can use this information to identify traffic associated with scanning, attacks, botnets, or other suspicious activity and then apply an appropriate action. Reputation should be treated as one signal rather than the sole basis for all application security decisions because IP addresses can change and legitimate users may share infrastructure. It is most effective as part of layered protection that includes signatures, behavioral controls, bot mitigation, authentication, and protocol validation.

Question 39.

A FortiWeb administrator needs to determine why traffic was blocked by a web protection profile. What should be reviewed FIRST?

1. The corresponding FortiWeb attack or event log
2. Backend server wallpaper
3. Printer settings
4. Physical cable color

Correct Answer: 1. The corresponding FortiWeb attack or event log

Explanation:

FortiWeb attack and event logs provide the most direct evidence of why a request was blocked. They can identify the matched signature, rule, source address, URL, request details, severity, and action that was taken. Administrators can use this information to distinguish a real attack from a false positive and decide whether tuning or an exception is needed. Logging is also important for identifying recurring threats and understanding attack patterns over time. Troubleshooting should begin with the security event that triggered the enforcement decision rather than unrelated physical or infrastructure settings.

Question 40.

Which statement BEST describes effective FortiWeb policy administration?

1. Enable maximum blocking everywhere without testing
2. Use staged deployment, monitor logs, tune protections, validate exceptions, and review policies regularly
3. Disable logging after the initial deployment
4. Rely only on one attack signature category

Correct Answer: 2. Use staged deployment, monitor logs, tune protections, validate exceptions, and review policies regularly

Explanation:

Web applications evolve continually, so FortiWeb policy requires ongoing administration. A staged deployment allows administrators to observe normal behavior before strict enforcement, while logs provide evidence for tuning signatures, behavioral protections, bot controls, protocol limits, and access rules. False positives should be handled with carefully scoped exceptions rather than broad protection disablement. Application updates, new APIs, traffic changes, and emerging threats may require policy adjustment. Regular review also ensures obsolete exceptions and unused rules are removed. Effective FortiWeb administration therefore combines layered protection, monitoring, controlled tuning, and continuous validation rather than treating the initial configuration as permanent.