View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 61.

A FortiWeb administrator wants to ensure that traffic is forwarded only to backend servers that are actually serving the application correctly. Which configuration is MOST important?

1. Application-aware server health checks
2. IP reputation filtering
3. Attack signature exceptions
4. Administrator password aging

Correct Answer: 1. Application-aware server health checks

Explanation:

Application-aware health checks verify more than basic network connectivity. FortiWeb can send HTTP or HTTPS requests to a defined application resource and evaluate whether the response indicates that the service is functioning correctly. A server might accept TCP connections while the application itself is unavailable or returning errors, so simple reachability testing may not be sufficient. By using an application-aware check, FortiWeb can temporarily remove unhealthy members from load-balancing decisions and restore them when they recover. This helps maintain application availability and prevents clients from being sent to backend systems that are technically reachable but unable to provide the expected service.

Question 62.

A FortiWeb deployment uses several backend servers, and the administrator wants requests distributed across all healthy members. Which feature should be configured?

1. URL rewriting
2. Server load balancing
3. Data leak prevention
4. IP reputation

Correct Answer: 2. Server load balancing

Explanation:

Server load balancing distributes incoming requests among multiple healthy backend servers. FortiWeb can use a configured algorithm to determine which server pool member receives each request. Combined with health checks, load balancing improves both scalability and availability because unavailable servers can be temporarily excluded from service. Session persistence may also be added when an application requires a user to remain associated with the same backend system. Data leak prevention and IP reputation are security controls, while load balancing is specifically designed to manage how client traffic is distributed among application servers.

Question 63.

A web application stores user session state locally on each backend server. What should the FortiWeb administrator configure to avoid session disruption?

1. Attack signature exceptions
2. HTTP method blocking
3. Session persistence
4. IP reputation filtering

Correct Answer: 3. Session persistence

Explanation:

When session state is stored locally on individual backend servers, users may need to continue reaching the same server for the duration of their session. Session persistence helps FortiWeb maintain that association so subsequent requests are routed consistently to the same backend member. Without persistence, load balancing could direct later requests to another server that does not contain the user’s session state, resulting in authentication problems or lost application context. The persistence method should match the application architecture and session behavior. This is primarily an application delivery function rather than an attack-detection capability.

Question 64.

What is a potential security benefit of configuring HTTPS between FortiWeb and the backend application server?

1. It disables attack signatures
2. It removes the need for certificates
3. It prevents FortiWeb from inspecting requests
4. It protects application data on the backend network segment**

Correct Answer: 4. It protects application data on the backend network segment

Explanation:

Using HTTPS between FortiWeb and the backend server maintains encryption after FortiWeb has inspected the client request. This can be important when the internal network is not considered fully trusted or when compliance requirements require encryption in transit throughout the application path. FortiWeb can terminate the client TLS connection, inspect the decrypted HTTP content, and then establish a separate encrypted connection toward the backend. Administrators should configure certificate validation appropriately so encryption also provides meaningful server authentication. Backend HTTPS does not prevent FortiWeb from performing web application security inspection.

Question 65.

Which FortiWeb control can help stop requests that contain abnormally large HTTP headers?

1. HTTP protocol constraints
2. Server persistence
3. Static routing
4. Load balancing

Correct Answer: 1. HTTP protocol constraints

Explanation:

HTTP protocol constraints can enforce acceptable limits on request elements such as header lengths, request size, parameter count, methods, and other structural characteristics. Attackers may use malformed or oversized requests to consume resources, exploit parsing weaknesses, or bypass poorly implemented application controls. FortiWeb can reject requests that exceed configured limits before they reach the application. These settings should be tuned according to legitimate traffic because overly restrictive thresholds can generate false positives. Protocol validation complements signatures by checking whether requests conform to expected HTTP behavior.

Question 66.

An application never requires the HTTP DELETE method. What is the BEST FortiWeb configuration?

1. Allow DELETE for compatibility
2. Block DELETE if it is not part of legitimate application behavior
3. Convert DELETE requests into GET requests
4. Disable all HTTP methods

Correct Answer: 2. Block DELETE if it is not part of legitimate application behavior

Explanation:

Allowing only required HTTP methods reduces the application’s exposed functionality and follows the principle of least functionality. If DELETE is never used legitimately, there is little reason to allow clients to submit it. Restricting unused methods can reduce opportunities for abuse, especially in applications or APIs where improper method handling could expose sensitive operations. Administrators should first confirm normal application behavior so valid methods are not blocked accidentally. Method restrictions should be combined with proper authorization, signatures, behavioral controls, and secure application design.

Question 67.

A FortiWeb administrator wants to detect known cross-site scripting patterns in HTTP requests. Which feature should be enabled?

1. Server health checks
2. Static routing
3. Web attack signatures
4. Session persistence

Correct Answer: 3. Web attack signatures

Explanation:

Web attack signatures inspect HTTP traffic for known malicious patterns associated with threats such as cross-site scripting, SQL injection, command injection, file inclusion, and other application-layer attacks. When a signature matches, FortiWeb can log, alert, or block the request according to policy. Signatures provide strong coverage against recognized attack techniques but should be used together with behavioral detection, protocol validation, access control, and secure coding. Health checks and persistence affect application delivery rather than malicious payload detection.

Question 68.

A legitimate API request triggers one FortiWeb attack signature because of a specific JSON parameter. What is the BEST response?

1. Disable all signatures
2. Bypass FortiWeb for the API
3. Allow all traffic from the client permanently
4. Validate the request and create a narrowly scoped exception**

Correct Answer: 4. Validate the request and create a narrowly scoped exception

Explanation:

False positives should be resolved as narrowly as possible. The administrator should verify that the API request is legitimate, determine which parameter and signature caused the match, and create an exception limited to that specific context. This preserves protection for other parameters, URLs, clients, and application functions. Disabling an entire signature category or bypassing FortiWeb could expose the API to unrelated attacks. Exceptions should also be documented and reviewed periodically to determine whether they are still required as the application changes.

Question 69.

What is the PRIMARY reason to use behavioral or machine-learning protection in addition to attack signatures?

1. To detect unusual application behavior that may not match known signatures
2. To eliminate the need for backend servers
3. To disable all security logs
4. To replace application authentication

Correct Answer: 1. To detect unusual application behavior that may not match known signatures

Explanation:

Attack signatures are effective against known patterns, but new or customized attacks may not match an existing rule exactly. Behavioral or machine-learning protection can establish a model of legitimate application activity and identify requests that deviate significantly from expected patterns. This adds another detection layer for emerging threats and abnormal behavior. The model should be trained and tuned using representative legitimate traffic before strict blocking is applied. Machine learning does not eliminate the need for signatures, authentication, secure coding, or operational monitoring; it complements those controls.

Question 70.

Why is a learning period useful before enabling strict machine-learning enforcement on FortiWeb?

1. It makes TLS unnecessary
2. It helps establish legitimate application behavior and reduce false positives
3. It disables backend health checks
4. It prevents event logging

Correct Answer: 2. It helps establish legitimate application behavior and reduce false positives

Explanation:

A learning period allows FortiWeb to observe normal application traffic, including typical URLs, parameters, methods, request structures, and user behavior. If enforcement begins before the model has seen enough representative activity, legitimate but uncommon requests may appear suspicious and be blocked. Administrators should therefore monitor detections, verify learned patterns, and tune policies before moving to strict enforcement. Seasonal workflows, APIs, administrative tasks, and scheduled processes should be represented where possible. Proper learning improves accuracy without eliminating the need for other security controls.

Question 71.

A login page is receiving thousands of automated authentication attempts. Which FortiWeb capabilities are MOST relevant?

1. Bot mitigation and rate limiting
2. Server persistence and load balancing only
3. Static routing and DNS forwarding
4. TLS offloading only

Correct Answer: 1. Bot mitigation and rate limiting

Explanation:

Automated login attacks such as credential stuffing and brute-force attempts often generate repeated authentication requests at a high rate. Bot mitigation can help identify automated clients, while rate limiting can reduce the number of requests allowed within a defined period. These controls should be tuned so legitimate users are not affected, particularly when many clients share a proxy or NAT address. They work best alongside strong authentication, multifactor authentication, account monitoring, and application-level lockout protections. Load balancing alone distributes the traffic but does not mitigate the attack.

Question 72.

An administrator wants to limit access to /admin so that only internal management networks can reach it. Which feature is MOST suitable?

1. Server health checking
2. Source-based URL access control
3. Session persistence
4. Signature update scheduling

Correct Answer: 2. Source-based URL access control

Explanation:

Source-based URL access control can restrict a sensitive path such as /admin so it is reachable only from approved network ranges. This reduces exposure by preventing internet clients from even reaching the management interface. The control should complement strong authentication and authorization because source address alone is not a complete identity mechanism. Administrators should account for VPN users, remote administrators, and other legitimate access paths when defining allowed networks. Restricting access to sensitive URLs is a straightforward way to reduce the attack surface of a protected application.

Question 73.

A company wants to block access to an obsolete application path that is still present on the backend server. Which FortiWeb feature is MOST appropriate?

1. Load balancing
2. Data leak prevention
3. URL access rules
4. IP reputation

Correct Answer: 3. URL access rules

Explanation:

URL access rules can define how requests to specific application paths are handled. If a legacy path should no longer be accessible, FortiWeb can deny requests to that path even while the backend resource still exists. This can reduce attack surface during application migration or cleanup. Administrators should confirm the path is truly obsolete before blocking it and monitor logs for attempted access. The underlying application should eventually remove unused functionality as well, because WAF controls complement rather than replace secure application maintenance.

Question 74.

A web application is accidentally returning payment card information in responses. Which FortiWeb capability is MOST relevant for detecting this exposure?

1. Server persistence
2. Load balancing
3. Static routing
4. Data leak prevention**

Correct Answer: 4. Data leak prevention

Explanation:

Data leak prevention can inspect web responses for patterns associated with sensitive information such as payment card data, personal identifiers, or other confidential content. Depending on configuration, FortiWeb can log, alert, mask, or take another action when protected information is detected. DLP should be tuned carefully because overly broad patterns can generate false positives. It should also complement proper application authorization, secure development, database controls, and data minimization. The best outcome is to prevent sensitive data from being exposed by the application in the first place.

Question 75.

An application accepts image uploads but should reject executable files. What should the FortiWeb administrator configure?

1. File upload restrictions based on legitimate application requirements
2. A broader session persistence policy
3. Static routing
4. Disabled HTTP inspection

Correct Answer: 1. File upload restrictions based on legitimate application requirements

Explanation:

Upload controls should reflect what the application legitimately needs. If users only need to submit images, executable files and unrelated formats should be rejected. Administrators should also consider maximum file sizes and malware-related inspection where appropriate. The backend application should store uploaded files securely and should not execute user-supplied content. Restricting uploads reduces attack surface and limits opportunities for malicious file placement. Disabling inspection would remove valuable protection and is the opposite of the desired security outcome.

Question 76.

Why should FortiWeb administrators avoid relying only on source IP reputation when deciding whether traffic is malicious?

1. Reputation cannot be used with HTTPS
2. Source addresses can change, be shared, or provide incomplete context
3. IP reputation works only on backend servers
4. Reputation automatically disables signatures

Correct Answer: 2. Source addresses can change, be shared, or provide incomplete context

Explanation:

IP reputation is useful as an additional security signal, but it is not definitive. Attackers can move between addresses, legitimate users may share addresses through proxies or NAT, and cloud infrastructure can host both benign and malicious activity. FortiWeb should therefore combine reputation with request inspection, web attack signatures, behavioral analysis, bot detection, authentication, rate controls, and other contextual information. Layered security reduces the risk of both false positives and missed attacks that can occur when one indicator is treated as absolute.

Question 77.

An administrator notices repeated requests for sensitive files that do not exist on the application. What should the administrator use to investigate the pattern?

1. FortiWeb attack and traffic logs
2. Printer history
3. Desktop configuration
4. Physical server labels

Correct Answer: 1. FortiWeb attack and traffic logs

Explanation:

Logs can reveal source addresses, requested URLs, HTTP methods, matched rules, response codes, timestamps, and other information that helps administrators determine whether repeated requests represent scanning, reconnaissance, bot activity, or another attack pattern. Reviewing multiple related events can reveal trends that are not obvious from a single request. This information may support additional controls such as access rules, bot mitigation, rate limiting, or IP reputation actions. Effective logging and retention are essential for both operational troubleshooting and security investigation.

Question 78.

A protected application begins generating many false positives immediately after a major application update. What should the administrator do?

1. Disable FortiWeb permanently
2. Review the changed URLs, parameters, request patterns, and relevant protection settings
3. Remove all backend servers
4. Disable all logging

Correct Answer: 2. Review the changed URLs, parameters, request patterns, and relevant protection settings

Explanation:

Major application updates can introduce new URLs, parameters, APIs, request formats, methods, or workflow patterns. Existing FortiWeb policies may interpret these changes as abnormal or malicious. Administrators should review affected events and compare them with the new application behavior, then adjust signatures, exceptions, protocol constraints, or behavioral models as needed. Broadly disabling protection would create unnecessary exposure. Security policy should evolve with the application so enforcement remains accurate after significant changes.

Question 79.

A FortiWeb administrator wants to validate a new restrictive policy before applying it to all production users. What is the BEST approach?

1. Test or monitor the policy against representative traffic before broad enforcement
2. Enable maximum blocking globally immediately
3. Disable logging during deployment
4. Bypass FortiWeb for production users

Correct Answer: 1. Test or monitor the policy against representative traffic before broad enforcement

Explanation:

A staged deployment allows administrators to identify false positives and compatibility problems before a restrictive policy affects the entire application population. Representative traffic should include common user workflows, APIs, administrative functions, uploads, unusual but legitimate requests, and other important application behavior. Logs and monitoring can then be reviewed to tune the configuration. After the policy behaves as expected, enforcement can be expanded. Immediate global blocking may cause unnecessary outages, while disabling logging removes the evidence required to understand problems.

Question 80.

Which statement BEST describes a mature FortiWeb security program?

1. Enable signatures once and never review them again
2. Rely only on IP reputation
3. Disable logs after deployment
4. Combine application-aware deployment, layered protections, traffic monitoring, policy tuning, backend health checks, controlled exceptions, and continuous review**

Correct Answer: 4. Combine application-aware deployment, layered protections, traffic monitoring, policy tuning, backend health checks, controlled exceptions, and continuous review

Explanation:

A mature FortiWeb deployment combines security controls with ongoing application and operational knowledge. Administrators should maintain appropriate deployment architecture, TLS handling, backend pools, health checks, and load-balancing settings while applying layered controls such as signatures, behavioral protection, bot mitigation, protocol validation, access rules, file controls, and data protection. Logs should be reviewed for attacks and false positives, and exceptions should remain narrowly scoped and periodically reassessed. Because applications, APIs, certificates, backend infrastructure, and threats change continuously, FortiWeb security must be actively maintained rather than treated as a one-time configuration.