View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 101.

A FortiWeb administrator wants to verify whether users are repeatedly requesting a sensitive URL that should rarely be accessed. Which source should be reviewed first?

1. FortiWeb traffic and attack logs
2. Backend desktop wallpaper settings
3. Printer queues
4. Server rack labels

Correct Answer: 1. FortiWeb traffic and attack logs

Explanation:

FortiWeb logs provide the clearest record of who is requesting a protected resource, when the requests occur, which URLs are involved, what source addresses generated the traffic, and whether any security rule was triggered. Repeated requests to a sensitive path may indicate scanning, misuse, automated activity, or a legitimate application workflow that needs review. By correlating events over time, administrators can determine whether additional controls such as source restrictions, authentication, rate limiting, or bot mitigation are appropriate. Physical server information and unrelated endpoint settings do not provide meaningful insight into application-layer access patterns.

Question 102.

A backend server responds to TCP connections but returns the wrong application page. Which health-check design is BEST?

1. Ping only
2. Use an HTTP or HTTPS health check that validates an expected response
3. Check only the MAC address
4. Disable health monitoring

Correct Answer: 2. Use an HTTP or HTTPS health check that validates an expected response

Explanation:

A server can be reachable at the network and transport layers while the application itself is misconfigured or unhealthy. An application-aware health check can request a specific URL and verify an expected response code, page content, or other characteristic. This lets FortiWeb determine whether the server is truly capable of handling the protected application. If the expected response is missing or incorrect, the server can be excluded from load balancing until it recovers. Basic connectivity checks alone may not detect application-level failures, so health monitoring should reflect the actual service that users depend on.

Question 103.

A web application stores session state only on the backend server where the session began. Which FortiWeb capability should be used?

1. Signature exceptions
2. IP reputation
3. Session persistence
4. Data leak prevention

Correct Answer: 3. Session persistence

Explanation:

Session persistence ensures that requests from the same client or session continue reaching the same backend server. This is important when application state is stored locally rather than in a shared database or distributed session store. Without persistence, requests may be load balanced to different servers, causing unexpected logouts, missing session data, or application errors. The administrator should select a persistence method that matches how the application identifies users and sessions. Persistence supports application delivery and availability, whereas attack signatures and reputation settings address different security functions.

Question 104.

FortiWeb decrypts HTTPS traffic from clients and then establishes HTTPS to the backend server. What is the main benefit of this design?

1. It disables WAF inspection
2. It eliminates the need for certificates
3. It bypasses load balancing
4. It preserves encryption on both network segments while still allowing inspection**

Correct Answer: 4. It preserves encryption on both network segments while still allowing inspection

Explanation:

In this design, FortiWeb terminates the client-side TLS session so that it can inspect the HTTP content and apply application-layer security controls. After inspection, it creates a second encrypted TLS connection to the backend server. This protects data both from the client to FortiWeb and from FortiWeb to the application server. Such re-encryption is useful when internal networks are not fully trusted or when compliance requirements mandate encryption throughout the communication path. Proper certificate validation should also be used so that backend encryption provides meaningful server authentication in addition to confidentiality.

Question 105.

A protected API never receives request bodies larger than 1 MB. Which configuration BEST reduces unnecessary exposure?

1. Configure an appropriate maximum request size near the legitimate requirement
2. Allow unlimited request sizes
3. Disable request inspection
4. Increase server pool size only

Correct Answer: 1. Configure an appropriate maximum request size near the legitimate requirement

Explanation:

Request-size limits help enforce expected application behavior and reduce the risk of resource exhaustion or malformed oversized requests. If the API legitimately never receives bodies larger than 1 MB, the administrator can set a limit that accommodates normal traffic with reasonable tolerance. Requests that exceed the expected size can then be rejected before reaching the backend. Limits should be tested carefully so valid traffic is not blocked. This is part of protocol hardening and should work alongside signatures, authentication, rate controls, and secure API design.

Question 106.

An application uses only GET and POST. Which FortiWeb configuration BEST supports least functionality?

1. Permit every HTTP method
2. Allow GET and POST and block unnecessary methods
3. Disable HTTP inspection
4. Convert all requests to POST

Correct Answer: 2. Allow GET and POST and block unnecessary methods

Explanation:

Allowing only the HTTP methods required by the application reduces exposed functionality and prevents unnecessary request types from reaching the backend. If the application uses only GET and POST, methods such as PUT, DELETE, TRACE, or others should generally be blocked unless there is a documented need. Administrators should verify application behavior before enforcement to avoid disrupting legitimate features. Method restriction is one layer of defense and complements access control, authorization, signatures, behavioral protection, and secure application coding.

Question 107.

Which FortiWeb feature is MOST appropriate for detecting known remote file inclusion attack patterns?

1. Load balancing
2. Session persistence
3. Web attack signatures
4. Server health checks

Correct Answer: 3. Web attack signatures

Explanation:

Web attack signatures are designed to recognize known malicious patterns associated with application-layer attacks, including file inclusion, SQL injection, cross-site scripting, command injection, and other exploit techniques. When a request matches a configured signature, FortiWeb can block or log the request depending on policy. Signature-based detection is strongest when combined with behavioral analysis, protocol constraints, URL access controls, and secure coding practices. Load balancing and health checks support application availability but do not inspect request payloads for known exploit content.

Question 108.

A legitimate request is blocked because one field matches a web attack signature. What should the administrator do after confirming the traffic is safe?

1. Disable the entire WAF
2. Remove all signatures
3. Allow all traffic from the source
4. Create the narrowest practical signature exception**

Correct Answer: 4. Create the narrowest practical signature exception

Explanation:

A false positive should be addressed with the smallest possible policy change. The administrator should identify the specific URL, field, parameter, and signature involved and create an exception limited to that context. This preserves protection for the rest of the application and avoids introducing a broad security gap. Global signature disablement or WAF bypass would expose unrelated application functions. Exceptions should also be documented and periodically reviewed because they may become unnecessary after application changes or software updates.

Question 109.

What is the main advantage of behavioral detection over relying only on signatures?

1. It can identify abnormal requests that may not match known attack patterns
2. It removes the need for application security
3. It automatically patches the backend application
4. It prevents all false positives

Correct Answer: 1. It can identify abnormal requests that may not match known attack patterns

Explanation:

Behavioral detection can build a model of legitimate application traffic and identify deviations from that model. This helps detect unusual requests or previously unseen attack techniques that do not correspond exactly to known signatures. It is especially useful as an additional layer alongside signature-based protection. The model must be trained using representative legitimate traffic and tuned carefully because unusual but valid requests may otherwise be flagged. Behavioral security does not eliminate the need for secure coding, signatures, logging, or authentication, and it cannot guarantee zero false positives.

Question 110.

What should an administrator do before moving a new behavioral model into full blocking mode?

1. Delete all signatures
2. Review detected anomalies and confirm the model includes representative legitimate traffic
3. Disable event logging
4. Remove the backend server pool

Correct Answer: 2. Review detected anomalies and confirm the model includes representative legitimate traffic

Explanation:

A newly trained behavioral model may not yet have seen all valid workflows, especially uncommon administrative tasks, scheduled jobs, APIs, or seasonal traffic patterns. Administrators should review anomalies and ensure the model represents normal application behavior before enforcing strict blocking. A staged process of learning, monitoring, tuning, and then enforcement reduces false positives and minimizes disruption. Logs should remain enabled throughout this process because they provide the evidence required to evaluate model accuracy and refine the policy.

Question 111.

A login page is receiving large numbers of automated attempts from scripts. Which FortiWeb controls are MOST relevant?

1. Bot mitigation and rate limiting
2. Load balancing only
3. Static routing and DNS forwarding
4. Session persistence only

Correct Answer: 1. Bot mitigation and rate limiting

Explanation:

Automated login abuse often relies on scripts or bot infrastructure to submit many authentication attempts. Bot mitigation can help identify automation, while rate limiting can restrict the frequency of requests to sensitive endpoints. These controls can reduce brute-force attacks, credential stuffing, and account enumeration. Administrators should tune thresholds carefully so legitimate users are not affected, especially when traffic comes through proxies or shared networks. These controls should also be combined with strong authentication, multifactor authentication, secure password practices, and account monitoring.

Question 112.

An administrative URL should be accessible only from a defined internal subnet. Which FortiWeb control BEST meets this requirement?

1. Increase HTTP request limits
2. Apply source-based access control to the URL
3. Disable HTTPS
4. Enable broader persistence

Correct Answer: 2. Apply source-based access control to the URL

Explanation:

Source-based access control can restrict access to a sensitive path so that only approved network ranges can reach it. This reduces external exposure and is especially useful for administrative interfaces that should not be publicly reachable. The administrator should still enforce strong authentication because source network location alone does not prove user identity. VPN and remote-administration ranges should be considered when defining allowed sources. The control directly limits who can access the resource, unlike request-size or persistence settings.

Question 113.

A deprecated API endpoint remains available on the backend but should no longer be reachable by clients. Which feature should be used?

1. Server health check
2. Session persistence
3. URL access control
4. IP reputation only

Correct Answer: 3. URL access control

Explanation:

URL access control can deny requests to a specific application path or endpoint, making it useful for blocking deprecated APIs while backend cleanup is still underway. This reduces attack surface by preventing clients or scanners from reaching functionality that should no longer be used. Administrators should verify that no valid business process depends on the endpoint before enforcing the block. Logs should also be monitored for continued access attempts. The long-term goal should still be to remove obsolete functionality from the application itself.

Question 114.

A web application is returning personally identifiable information in error messages. Which FortiWeb capability is MOST relevant?

1. Static routing
2. Session persistence
3. Load balancing
4. Data leak prevention**

Correct Answer: 4. Data leak prevention

Explanation:

Data leak prevention can inspect responses for patterns associated with sensitive information and apply an action when protected data appears. This can help identify accidental exposure through application errors, API responses, or poorly designed pages. Depending on configuration, FortiWeb may log, alert, mask, or otherwise handle the response. DLP should be tuned carefully and used alongside secure coding, proper error handling, access controls, and data minimization. The preferred long-term solution is to ensure the application itself does not return unnecessary sensitive information.

Question 115.

A file upload page is intended to accept JPEG and PNG files only. Which policy BEST reduces risk?

1. Allow only the required file types and enforce appropriate size limits
2. Accept all file extensions
3. Disable request inspection
4. Increase backend server count

Correct Answer: 1. Allow only the required file types and enforce appropriate size limits

Explanation:

An allowlist approach to file uploads reduces the attack surface by accepting only content required by the business workflow. If the application expects JPEG and PNG images, other file types such as scripts or executables should be rejected. File-size limits can also reduce resource abuse. Where available, malware inspection can provide another layer of defense. The application should validate content independently and store uploads securely. Allowing unnecessary file types or disabling inspection would increase risk without providing a business benefit.

Question 116.

Why should FortiWeb IP reputation be treated as an additional signal rather than the sole basis for blocking traffic?

1. Reputation databases cannot be updated
2. IP addresses may be shared, dynamic, or insufficient to describe the intent of each request
3. Reputation works only for backend traffic
4. IP reputation automatically disables TLS inspection

Correct Answer: 2. IP addresses may be shared, dynamic, or insufficient to describe the intent of each request

Explanation:

IP reputation can identify sources associated with malicious or suspicious activity, but source addresses are not always reliable indicators of intent. Legitimate users may share an address through NAT, proxies, or cloud infrastructure, while attackers can change source networks. Reputation should therefore be combined with application signatures, behavioral analysis, bot mitigation, authentication, rate limits, and request context. Layered controls provide better accuracy and resilience than relying on a single signal. This reduces the chance of both false positives and missed attacks.

Question 117.

A FortiWeb administrator notices a sudden increase in blocked requests after a new application release. What should be reviewed FIRST?

1. FortiWeb logs and the application’s new request patterns
2. Physical server rack location
3. Printer settings
4. Desktop wallpaper

Correct Answer: 1. FortiWeb logs and the application’s new request patterns

Explanation:

Application releases can introduce new URLs, parameters, HTTP methods, request body formats, APIs, or behaviors that existing FortiWeb policies have not seen before. Logs can show which security controls are triggering and whether the blocked requests appear malicious or legitimate. Administrators should compare these events with the release changes and tune signatures, exceptions, protocol constraints, or behavioral models as necessary. Immediately weakening the entire WAF would be inappropriate. Policy should evolve with the protected application so that enforcement remains accurate after major changes.

Question 118.

A new API version causes the machine-learning model to classify valid requests as anomalous. What is the BEST response?

1. Disable FortiWeb permanently
2. Retrain or retune the model using the legitimate new API behavior
3. Block all API traffic
4. Remove event logging

Correct Answer: 2. Retrain or retune the model using the legitimate new API behavior

Explanation:

A major API change may alter paths, parameters, payload structures, methods, or normal request values. A behavioral model based on the previous version may interpret the new legitimate traffic as abnormal. Administrators should validate the new behavior and update the learning or tuning process so the model reflects the current application. Strict blocking should be delayed until the new model has been reviewed. This allows FortiWeb to maintain effective behavioral protection without generating unnecessary false positives after legitimate application evolution.

Question 119.

An administrator is preparing a highly restrictive policy for a critical production application. What is the BEST rollout strategy?

1. Test with representative traffic, monitor results, tune the policy, then expand enforcement
2. Enable maximum blocking everywhere immediately
3. Disable logs during deployment
4. Bypass FortiWeb until a problem occurs

Correct Answer: 1. Test with representative traffic, monitor results, tune the policy, then expand enforcement

Explanation:

A staged rollout reduces the chance that a configuration mistake or false positive will cause a widespread outage. Representative traffic should include normal user workflows, APIs, uploads, administrative functions, authentication, and less common legitimate operations. Logs can reveal which requests would be blocked and whether tuning is required. After validating the policy, administrators can expand enforcement with greater confidence. Immediate global blocking can turn small tuning problems into major application disruptions, while disabling logs removes the evidence needed for troubleshooting.

Question 120.

Which statement BEST describes mature FortiWeb administration?

1. Configure protection once and leave it unchanged
2. Use only attack signatures
3. Disable monitoring after deployment
4. Continuously review application behavior, logs, backend health, certificates, protections, exceptions, and policy effectiveness**

Correct Answer: 4. Continuously review application behavior, logs, backend health, certificates, protections, exceptions, and policy effectiveness

Explanation:

FortiWeb administration is an ongoing lifecycle because applications, APIs, certificates, backend infrastructure, traffic patterns, and threats change over time. Administrators should maintain health checks and server pools, monitor logs, update protection policies, tune behavioral models, review exceptions, and ensure TLS certificates remain valid. Application releases may introduce new functionality that requires policy adjustment, while old exceptions or URLs may become unnecessary. Continuous review keeps security aligned with current application behavior and reduces both security gaps and false positives. A mature WAF deployment combines technical protection with active operational management.