View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 81.

A FortiWeb administrator wants to identify repeated application attacks coming from the same source over time. Which resource should be reviewed?

1. FortiWeb logs and attack events
2. Backend printer settings
3. Server rack labels
4. Desktop wallpaper history

Correct Answer: 1. FortiWeb logs and attack events

Explanation:

FortiWeb logs provide the primary evidence needed to identify recurring attack patterns. Administrators can review source addresses, requested URLs, matched signatures, severity, timestamps, actions, and other request details to determine whether one source is repeatedly targeting the application. Correlating multiple events can reveal scanning, brute-force activity, bot behavior, or repeated exploitation attempts. This information can then support additional controls such as IP reputation actions, rate limiting, access rules, or bot mitigation. Physical infrastructure and unrelated endpoint settings do not provide the application-layer visibility required for this type of investigation.

Question 82.

A backend server passes a basic network check but consistently returns HTTP 500 errors. Which health check would BEST identify the problem?

1. ARP inspection
2. An HTTP or HTTPS health check that validates an expected response
3. A simple MAC address check
4. A VLAN membership test

Correct Answer: 2. An HTTP or HTTPS health check that validates an expected response

Explanation:

A basic connectivity test may confirm that the server is reachable, but it does not prove the application is functioning correctly. An HTTP or HTTPS health check can request a specific resource and validate an expected status code, content string, or other application-level response. If the server continuously returns an error such as HTTP 500, FortiWeb can consider that pool member unhealthy and stop forwarding new requests to it. Application-aware health checks provide a more accurate view of service availability than simple network reachability tests.

Question 83.

An application has two backend servers, but users lose their session when requests alternate between them. Which FortiWeb setting should be reviewed?

1. IP reputation
2. Attack signature severity
3. Session persistence
4. Data leak prevention

Correct Answer: 3. Session persistence

Explanation:

If an application stores session state locally on each backend server, requests from the same user must often continue reaching the same server. Without session persistence, load balancing may send successive requests to different backend members, causing lost sessions, unexpected logouts, or missing application state. Configuring an appropriate persistence method helps keep users associated with the same backend server for the required period. IP reputation, signature severity, and DLP influence security behavior rather than backend session affinity.

Question 84.

What is the MAIN reason to configure FortiWeb to re-encrypt traffic to a backend server?

1. To disable WAF inspection
2. To remove the need for certificates
3. To prevent all server health checks
4. To maintain confidentiality on the FortiWeb-to-server connection**

Correct Answer: 4. To maintain confidentiality on the FortiWeb-to-server connection

Explanation:

Re-encrypting traffic ensures that application data remains protected after FortiWeb completes inspection and forwards the request toward the backend server. This is particularly important when internal networks are not considered fully trusted or when compliance requirements demand encryption in transit across all network segments. FortiWeb can terminate the client TLS session, inspect the decrypted request, and establish a separate HTTPS session to the backend. Proper certificate validation should also be configured. Re-encryption does not prevent FortiWeb inspection because inspection takes place before the second encrypted connection is established.

Question 85.

A web application never expects request bodies larger than 5 MB. What is the BEST FortiWeb configuration?

1. Configure a suitable request-size limit close to the legitimate application requirement
2. Allow unlimited request sizes
3. Disable HTTP inspection
4. Increase every backend server’s storage

Correct Answer: 1. Configure a suitable request-size limit close to the legitimate application requirement

Explanation:

Request-size limits help prevent abnormally large requests from consuming resources or exploiting application weaknesses. If the application legitimately accepts no more than 5 MB, the administrator can configure a reasonable limit that accommodates normal traffic while rejecting excessive requests. The exact value should include any necessary operational tolerance. Limits that are too low may block valid users, while unlimited requests provide no protection against oversized payload abuse. Request-size constraints are one component of HTTP protocol validation and should be tuned according to real application behavior.

Question 86.

A protected API uses GET, POST, and PUT but never uses TRACE. What is the BEST policy decision?

1. Allow every HTTP method
2. Permit the required methods and block unnecessary TRACE requests
3. Disable API inspection
4. Convert TRACE into POST

Correct Answer: 2. Permit the required methods and block unnecessary TRACE requests

Explanation:

Restricting HTTP methods to those actually used by the application reduces exposed functionality and supports least-functionality principles. If GET, POST, and PUT are legitimate but TRACE is never required, the administrator should allow the required methods and reject TRACE. This reduces the opportunity for misuse without affecting valid application workflows. Method restrictions should be based on an accurate understanding of the application and APIs. They complement authorization, attack signatures, behavioral analysis, and secure coding rather than replacing those controls.

Question 87.

A FortiWeb administrator needs to stop known SQL injection payloads. Which protection is MOST directly applicable?

1. Load balancing
2. Static routing
3. Web attack signatures
4. Server persistence

Correct Answer: 3. Web attack signatures

Explanation:

Web attack signatures are designed to detect known malicious application-layer patterns, including SQL injection. FortiWeb can inspect request parameters, headers, bodies, and other relevant content for patterns associated with injection attacks. When a signature matches, the configured policy can block, alert, or otherwise handle the request. Signature protection should be used alongside secure application coding, behavioral controls, and protocol validation. Load balancing and persistence manage application delivery and do not inspect request content for SQL injection.

Question 88.

A specific legitimate URL is blocked because one request parameter resembles a known attack. What is the BEST way to handle the false positive?

1. Disable the entire WAF
2. Disable all signatures
3. Allow every request from that source address
4. Create a narrow exception for the specific validated request condition**

Correct Answer: 4. Create a narrow exception for the specific validated request condition

Explanation:

False positives should be corrected with the smallest possible exception. The administrator should confirm that the request is legitimate, identify the exact URL, parameter, and signature involved, and create an exception only for that specific context. This preserves protection for the rest of the application and avoids creating a broad security gap. Disabling the WAF or all signatures would expose unrelated application functions. Exceptions should also be documented and reviewed periodically because they may become unnecessary as the application changes.

Question 89.

What is the main security benefit of FortiWeb behavioral analysis?

1. It can identify requests that differ significantly from learned legitimate application behavior
2. It replaces all backend authentication
3. It eliminates the need for logs
4. It automatically patches vulnerable source code

Correct Answer: 1. It can identify requests that differ significantly from learned legitimate application behavior

Explanation:

Behavioral analysis can model how a web application normally receives requests and then flag significant deviations. This can help identify previously unseen attacks, unusual parameter values, abnormal request structures, or other suspicious activity that may not match known signatures. The quality of detection depends on representative learning and careful tuning. Behavioral analysis should therefore be used alongside signatures, access controls, bot protection, and secure development practices. It provides an additional layer of defense rather than replacing other security controls.

Question 90.

Before switching a newly created behavioral policy from monitoring to blocking, what should the administrator do?

1. Remove all signatures
2. Review learned behavior and validate detected anomalies against legitimate traffic
3. Disable logging
4. Remove the server pool

Correct Answer: 2. Review learned behavior and validate detected anomalies against legitimate traffic

Explanation:

Before strict enforcement, administrators should ensure the behavioral model has observed a representative range of legitimate application activity. They should review anomalies and confirm that normal workflows, APIs, administrative actions, scheduled tasks, and less common user behaviors are not being incorrectly classified. This tuning step helps reduce false positives once blocking begins. Moving directly to enforcement without validation can disrupt legitimate application use. Monitoring and review allow administrators to refine the model before making it authoritative.

Question 91.

A public login page is being targeted by automated credential stuffing. Which FortiWeb control combination is MOST useful?

1. Bot mitigation and rate limiting
2. Server persistence and static routing
3. Load balancing only
4. TLS offloading only

Correct Answer: 1. Bot mitigation and rate limiting

Explanation:

Credential stuffing relies on automation and repeated authentication attempts using stolen username and password combinations. Bot mitigation can help identify automated clients, while rate limiting can restrict excessive request frequency. These controls should be tuned carefully so legitimate users are not affected, especially when many users share a NAT or proxy. They are most effective when combined with strong application authentication, multifactor authentication, account monitoring, and appropriate lockout strategies. Load balancing can distribute abusive traffic but does not stop the attack itself.

Question 92.

An internal administrative application should be reachable only through the corporate VPN. Which FortiWeb control BEST enforces this requirement?

1. Increase HTTP header limits
2. Restrict the application URL to approved VPN source networks
3. Disable HTTPS
4. Enable broader session persistence

Correct Answer: 2. Restrict the application URL to approved VPN source networks

Explanation:

Source-based access control can restrict a sensitive application or URL so that only addresses associated with the corporate VPN are allowed. This greatly reduces public exposure and complements authentication controls. Administrators should ensure the allowed address ranges accurately represent legitimate VPN users and should still require strong user authentication because network location alone is not a complete identity check. Restricting the management surface is more appropriate than changing protocol limits or session persistence because it directly controls who can reach the application.

Question 93.

A company has retired an old API endpoint but the backend path still exists temporarily. Which FortiWeb feature can block access to it?

1. Session persistence
2. Server health checks
3. URL access rules
4. IP reputation only

Correct Answer: 3. URL access rules

Explanation:

URL access rules can explicitly deny access to obsolete application paths while backend cleanup is still in progress. This reduces attack surface by preventing clients from reaching endpoints that should no longer be used. Administrators should verify that no legitimate business process depends on the URL before blocking it. Logs can then be monitored for continued access attempts, which may indicate old clients, scanners, or attackers. Ultimately, unused functionality should also be removed from the backend application because WAF controls complement but do not replace proper application maintenance.

Question 94.

A web application accidentally exposes confidential identifiers in HTTP responses. Which FortiWeb capability is MOST relevant?

1. Server persistence
2. Load balancing
3. Health checking
4. Data leak prevention**

Correct Answer: 4. Data leak prevention

Explanation:

Data leak prevention can inspect application responses for patterns associated with confidential information. Depending on configuration, FortiWeb can log, alert, mask, or take another defined action when protected data appears. This can help detect accidental data exposure caused by application errors, overly broad API responses, or poor data handling. DLP should be tuned carefully to avoid false positives and should supplement secure application design, authorization controls, and data minimization. The long-term fix should address why the application is returning sensitive information unnecessarily.

Question 95.

A file upload form should accept PDF documents only. What is the BEST FortiWeb approach?

1. Restrict uploads to the required file type and appropriate size limits
2. Allow all extensions
3. Disable request inspection
4. Increase session persistence

Correct Answer: 1. Restrict uploads to the required file type and appropriate size limits

Explanation:

When the business requirement is clearly defined, the upload policy should permit only the necessary content. Restricting file types and sizes reduces the risk of malicious executables, scripts, oversized payloads, or unrelated content reaching the application. Administrators should also consider file inspection and malware controls where appropriate. Backend application design remains important because uploaded content should be stored safely and should not be executed directly. An allowlist-oriented upload policy usually provides stronger protection than accepting every file type and trying to identify dangerous files afterward.

Question 96.

Why is IP reputation most effective when combined with other FortiWeb controls?

1. Reputation information can never be updated
2. A source address alone may not reliably indicate whether every request is malicious
3. Reputation works only on HTTP traffic
4. IP reputation disables attack signatures

Correct Answer: 2. A source address alone may not reliably indicate whether every request is malicious

Explanation:

Source addresses can change, be shared through NAT or proxies, or belong to cloud services used by both legitimate and malicious clients. Therefore, IP reputation is valuable context but should not be treated as the only security decision point. Combining it with signatures, behavior analysis, bot mitigation, authentication, request rate, protocol validation, and access rules provides stronger and more accurate protection. Layered controls can compensate when one signal is incomplete or misleading. This approach reduces both false positives and opportunities for attackers to evade protection simply by changing source infrastructure.

Question 97.

A FortiWeb administrator wants to determine whether a spike in blocked traffic represents a real attack or a policy tuning problem. What should be reviewed FIRST?

1. Relevant FortiWeb attack logs and request details
2. Physical server rack location
3. Printer queues
4. Desktop themes

Correct Answer: 1. Relevant FortiWeb attack logs and request details

Explanation:

Attack logs provide the evidence needed to determine what triggered the spike. Administrators can review matched signatures, URLs, parameters, source addresses, request methods, timestamps, and enforcement actions. If many requests show clearly malicious patterns from suspicious sources, the increase may represent a real attack. If normal application requests are consistently triggering the same rule after an application change, tuning may be required. Event-driven investigation allows administrators to make informed changes rather than weakening protection based on assumptions.

Question 98.

After a major API update, FortiWeb starts flagging many legitimate requests as abnormal. What is the BEST response?

1. Remove FortiWeb permanently
2. Review the new API behavior and retrain or retune the relevant protection policies
3. Disable all event logging
4. Block every API client

Correct Answer: 2. Review the new API behavior and retrain or retune the relevant protection policies

Explanation:

Major API changes can introduce new paths, parameters, methods, body structures, and legitimate request patterns that were not part of the previous behavior model. Administrators should compare the new application behavior with the FortiWeb detections, then update protocol constraints, signatures, exceptions, or behavioral learning as required. The objective is to align security policy with the new legitimate behavior without unnecessarily weakening protection. Application changes and WAF policy lifecycle should be coordinated so security controls remain accurate as the application evolves.

Question 99.

An administrator is preparing to enable a new restrictive FortiWeb policy in production. What is the BEST deployment approach?

1. Test with representative traffic, monitor events, tune the policy, and then expand enforcement
2. Enable maximum blocking globally immediately
3. Disable logs during rollout
4. Bypass FortiWeb until users complain

Correct Answer: 1. Test with representative traffic, monitor events, tune the policy, and then expand enforcement

Explanation:

A staged rollout reduces the likelihood of widespread application disruption. Administrators should evaluate the new policy against representative traffic that includes common workflows, APIs, uploads, authentication, and unusual but legitimate requests. Logs can then reveal false positives or unexpected interactions before strict enforcement reaches the full user population. After tuning and validation, enforcement can be expanded confidently. Immediate global blocking may turn small configuration errors into major outages, while disabling logs removes the evidence needed to diagnose problems.

Question 100.

Which statement BEST describes sound FortiWeb lifecycle management?

1. Configure the WAF once and never modify it
2. Use signatures only and ignore application changes
3. Disable monitoring after deployment
4. Continuously review application behavior, logs, protections, exceptions, backend health, certificates, and policy effectiveness**

Correct Answer: 4. Continuously review application behavior, logs, protections, exceptions, backend health, certificates, and policy effectiveness

Explanation:

FortiWeb security must evolve alongside the applications it protects. Administrators should regularly review logs for attacks and false positives, maintain signatures and behavioral models, reassess access rules and exceptions, verify backend health, and manage certificates before they expire. Application releases may introduce new URLs, APIs, methods, parameters, or traffic patterns that require policy changes. Infrastructure modifications can also affect server pools and load balancing. Continuous lifecycle management keeps the WAF aligned with current business behavior and threat conditions while reducing both unnecessary blocking and security gaps.