View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 121.

A FortiWeb administrator wants to protect a public application while hiding the IP addresses of the backend web servers from clients. Which deployment mode is MOST suitable?

1. Reverse proxy mode
2. Offline monitoring mode
3. Packet capture mode
4. DNS-only mode

Correct Answer: 1. Reverse proxy mode

Explanation:

In reverse proxy mode, clients connect to FortiWeb rather than directly to the protected backend servers. FortiWeb terminates the client connection, applies application-layer security controls, and establishes a separate connection to the backend. This architecture naturally hides the backend server addresses from external clients and provides extensive control over HTTP and HTTPS sessions. It also supports features such as TLS termination, load balancing, health checks, authentication integration, and content inspection. Reverse proxy mode is therefore appropriate when administrators want both strong application security and separation between public-facing services and the internal application infrastructure.

Question 122.

A FortiWeb server pool contains four members. One server repeatedly fails its configured health check. What should FortiWeb normally do?

1. Send more traffic to the failed server
2. Temporarily remove the unhealthy server from load balancing
3. Delete all members of the pool
4. Disable web protection

Correct Answer: 2. Temporarily remove the unhealthy server from load balancing

Explanation:

Health checks allow FortiWeb to determine whether backend servers can successfully provide the required application service. If a member fails the configured health check, FortiWeb can stop selecting it for new requests while continuing to use healthy members. The failed server can automatically return to service after it begins passing the health check again. This behavior improves application availability and prevents clients from being sent to a backend that is unreachable or malfunctioning. Administrators should configure health checks that accurately represent application health rather than relying only on simple network reachability.

Question 123.

An application maintains user sessions locally on each web server. What FortiWeb feature helps ensure a user continues to reach the same server?

1. Signature exceptions
2. Data leak prevention
3. Session persistence
4. IP reputation

Correct Answer: 3. Session persistence

Explanation:

Session persistence keeps requests associated with the same user or application session directed toward the same backend member. This is important when servers maintain session state locally instead of using a shared session repository. Without persistence, load balancing may send successive requests to different servers, causing users to lose authentication state or application context. FortiWeb supports persistence mechanisms that should be selected based on the application’s architecture. Persistence improves application continuity and is separate from security controls such as attack signatures, DLP, and IP reputation.

Question 124.

FortiWeb terminates the client HTTPS session and forwards requests to the backend using HTTPS. What does this configuration provide?

1. No application inspection
2. No need for certificates
3. Only Layer 2 protection
4. Inspection at FortiWeb while preserving encryption toward the backend**

Correct Answer: 4. Inspection at FortiWeb while preserving encryption toward the backend

Explanation:

FortiWeb can terminate the client-side TLS session, decrypt the HTTP traffic for inspection, and then establish a separate encrypted connection to the backend server. This allows application-layer protections to operate while keeping data encrypted on both sides of FortiWeb. Re-encryption is useful when the internal network segment must also be protected or when compliance requirements demand encryption in transit. Administrators should configure backend certificate trust correctly so the second TLS connection provides both confidentiality and meaningful server authentication.

Question 125.

A web application should never receive HTTP request bodies larger than 10 MB. Which FortiWeb control is MOST appropriate?

1. Configure a maximum request-body size consistent with legitimate application use
2. Allow unlimited request sizes
3. Disable web protection
4. Increase session persistence

Correct Answer: 1. Configure a maximum request-body size consistent with legitimate application use

Explanation:

Request-size limits help enforce normal application behavior and can reduce exposure to oversized payload attacks or resource-exhaustion attempts. If the application never legitimately receives bodies larger than 10 MB, FortiWeb can reject requests that exceed an appropriately configured threshold. Administrators should test the value carefully so valid uploads or API requests remain functional. Request-size control is part of protocol validation and should complement attack signatures, rate controls, authentication, and secure backend application design.

Question 126.

A protected application uses GET, POST, and PATCH but does not require DELETE. What is the BEST security policy?

1. Allow every HTTP method
2. Allow required methods and block DELETE
3. Convert DELETE into GET
4. Disable HTTP inspection

Correct Answer: 2. Allow required methods and block DELETE

Explanation:

Restricting HTTP methods to those actually required reduces unnecessary application functionality exposed to clients. If GET, POST, and PATCH are legitimate but DELETE is not used, blocking DELETE limits the opportunity for abuse or unexpected application behavior. Administrators should confirm all normal workflows before enabling the restriction, particularly for APIs where method usage may vary. Method control should be considered one layer of defense alongside authorization, attack signatures, protocol validation, and secure application coding.

Question 127.

Which FortiWeb capability is used to detect known cross-site scripting and command injection patterns?

1. Load balancing
2. Session persistence
3. Web attack signatures
4. Server health monitoring

Correct Answer: 3. Web attack signatures

Explanation:

Web attack signatures identify known malicious patterns in application traffic. They can detect threats such as cross-site scripting, SQL injection, command injection, file inclusion, and other recognized web attacks. When a signature matches, FortiWeb can block or log the request according to the configured protection policy. Signatures should be combined with behavioral analysis, protocol constraints, access control, and secure development practices. Load balancing and health checks improve application delivery but do not inspect payloads for malicious attack patterns.

Question 128.

A legitimate request to one application parameter is blocked by a FortiWeb signature. After validating the request, what should the administrator do?

1. Disable FortiWeb entirely
2. Disable all signatures
3. Bypass the application permanently
4. Create a narrowly scoped exception for the affected signature and request condition**

Correct Answer: 4. Create a narrowly scoped exception for the affected signature and request condition

Explanation:

False positives should be handled with the smallest possible exception. The administrator should identify the exact signature, URL, parameter, and request condition involved and create an exception limited to that legitimate case. This maintains protection across the rest of the application while resolving the operational issue. Broadly disabling signatures or bypassing FortiWeb would expose unrelated functionality. Exceptions should also be documented and periodically reviewed because application changes may eventually make them unnecessary.

Question 129.

What is the PRIMARY advantage of FortiWeb behavioral protection when compared with using signatures alone?

1. It can identify abnormal traffic patterns that do not match known signatures
2. It eliminates all false positives
3. It replaces application authentication
4. It automatically repairs vulnerable code

Correct Answer: 1. It can identify abnormal traffic patterns that do not match known signatures

Explanation:

Behavioral protection can learn how legitimate application requests normally look and identify significant deviations from that model. This provides an additional detection layer for attacks that may be new, customized, or otherwise not represented by a known signature. The model must be trained and tuned with representative traffic to avoid incorrectly classifying legitimate requests. Behavioral protection does not replace signatures, authentication, secure coding, or logging. Instead, it broadens coverage by combining anomaly detection with known-pattern detection.

Question 130.

Why should a FortiWeb administrator monitor a machine-learning model before enabling strict blocking?

1. To remove all server certificates
2. To ensure the model accurately represents legitimate application behavior
3. To disable logging
4. To prevent health checks

Correct Answer: 2. To ensure the model accurately represents legitimate application behavior

Explanation:

A machine-learning model requires exposure to representative legitimate traffic before it can reliably distinguish normal from abnormal requests. If strict blocking is enabled too quickly, valid but less common workflows may be classified as suspicious. Administrators should review anomalies, confirm that APIs and administrative functions are represented, and tune the model before enforcing strong blocking actions. This staged approach reduces false positives and improves confidence in the policy. Logs should remain enabled throughout learning and tuning because they provide essential evidence about model behavior.

Question 131.

A public login page is experiencing automated password spraying from many clients. Which FortiWeb capabilities are MOST relevant?

1. Bot mitigation and rate-based controls
2. Server persistence only
3. Load balancing only
4. DNS forwarding

Correct Answer: 1. Bot mitigation and rate-based controls

Explanation:

Password spraying and credential attacks often depend on automated requests sent repeatedly across many accounts. Bot mitigation can identify suspicious automation, while rate-based controls can restrict excessive activity against sensitive login endpoints. Administrators should tune thresholds carefully because distributed attacks may come from many addresses and legitimate users can share network infrastructure. These controls should complement multifactor authentication, strong password policies, account monitoring, and secure authentication logic. Load balancing alone would simply distribute the attack traffic among backend servers.

Question 132.

An administrative portal should be accessible only from a corporate management subnet. Which FortiWeb feature BEST enforces this requirement?

1. Increase request-body limits
2. Apply source-based access control to the portal URL
3. Disable HTTPS
4. Enable broader load balancing

Correct Answer: 2. Apply source-based access control to the portal URL

Explanation:

Source-based URL access control can limit a sensitive application path to approved network ranges. This is useful for administrative interfaces that should not be publicly reachable. The administrator can allow the corporate management subnet and deny other sources before requests reach the backend application. Strong authentication should still be required because source address does not prove user identity. Restricting access based on network location is an additional defense that reduces exposure and complements application authorization.

Question 133.

A company wants to prevent clients from accessing a retired application path that still exists temporarily on the backend. Which FortiWeb feature should be used?

1. Server health checking
2. Session persistence
3. URL access rules
4. TLS offloading

Correct Answer: 3. URL access rules

Explanation:

URL access rules allow administrators to control requests to specific application paths. A retired or deprecated URL can be explicitly denied so users, bots, or scanners cannot reach it while backend cleanup is still underway. This reduces application attack surface and helps enforce the intended public interface. Administrators should monitor logs for continued requests to the retired path, as they may indicate outdated clients or reconnaissance attempts. The backend functionality should ultimately be removed rather than relying permanently on WAF blocking.

Question 134.

An application response contains confidential data that should not be exposed to users. Which FortiWeb capability is MOST relevant?

1. Load balancing
2. Session persistence
3. Health checks
4. Data leak prevention**

Correct Answer: 4. Data leak prevention

Explanation:

Data leak prevention can inspect application responses for sensitive information patterns and apply configured actions when protected data is detected. This can help identify accidental exposure caused by poorly designed pages, verbose error messages, or excessive API responses. DLP should be tuned carefully to avoid false positives and should be combined with proper backend authorization, secure coding, and data minimization. The strongest long-term solution is to prevent the application from returning unnecessary sensitive information in the first place.

Question 135.

A file upload page should accept only DOCX and PDF files. What is the BEST FortiWeb policy approach?

1. Permit only the required file types and appropriate size limits
2. Allow all file types
3. Disable upload inspection
4. Increase server pool size

Correct Answer: 1. Permit only the required file types and appropriate size limits

Explanation:

File upload controls should reflect the actual business requirement. If the application needs only DOCX and PDF documents, other formats should be rejected to reduce unnecessary attack surface. Administrators should also enforce realistic size limits and use malware-related inspection where appropriate. The backend application should independently validate uploads and store them securely. An allowlist-oriented approach is generally safer than accepting every file type and attempting to identify dangerous content afterward.

Question 136.

Why should IP reputation not be the only FortiWeb control used to block application attacks?

1. Reputation cannot operate with HTTPS
2. Source IP addresses may be dynamic, shared, or insufficient to represent request intent
3. Reputation works only with backend servers
4. Reputation disables attack signatures

Correct Answer: 2. Source IP addresses may be dynamic, shared, or insufficient to represent request intent

Explanation:

IP reputation is useful for identifying sources associated with suspicious or malicious activity, but addresses can change and may be shared by many legitimate users through NAT, proxies, or cloud services. Attackers can also move between addresses. FortiWeb should therefore combine reputation with signatures, behavioral detection, bot mitigation, authentication, rate controls, and request context. A layered approach provides better accuracy and makes it more difficult for attackers to evade defenses by changing only their source infrastructure.

Question 137.

After an application update, FortiWeb begins blocking a large number of previously valid requests. What should the administrator review FIRST?

1. FortiWeb logs together with the new application request behavior
2. Printer configuration
3. Physical rack placement
4. Desktop themes

Correct Answer: 1. FortiWeb logs together with the new application request behavior

Explanation:

Application updates often introduce new URLs, parameters, body structures, HTTP methods, APIs, or workflows. Existing FortiWeb controls may interpret those changes as malicious or anomalous. Administrators should review the relevant events and compare them with the application’s release changes to determine whether signatures, protocol constraints, exceptions, or behavioral models need adjustment. Broadly disabling protection would create unnecessary exposure. WAF policy should evolve alongside the protected application so enforcement remains accurate.

Question 138.

A new API version changes request formats and causes behavioral protection to flag legitimate traffic. What is the BEST response?

1. Disable FortiWeb permanently
2. Retrain or retune the behavioral model using validated new API traffic
3. Block all API clients
4. Disable all logs

Correct Answer: 2. Retrain or retune the behavioral model using validated new API traffic

Explanation:

Behavioral models are based on previously observed legitimate traffic. A new API version may introduce different paths, parameters, JSON structures, methods, or normal values that the existing model has never seen. Administrators should verify the new behavior and update the learning process so the model reflects the current application. Monitoring should continue until the updated model is stable enough for blocking. This approach maintains the benefits of anomaly detection while reducing false positives after legitimate application changes.

Question 139.

An administrator wants to deploy a restrictive web protection profile to a critical application. What is the BEST implementation method?

1. Test with representative traffic, monitor results, tune the policy, and then expand enforcement
2. Enable maximum blocking globally without testing
3. Disable logs during deployment
4. Bypass FortiWeb until an attack occurs

Correct Answer: 1. Test with representative traffic, monitor results, tune the policy, and then expand enforcement

Explanation:

A staged implementation reduces operational risk. Representative testing should include normal users, APIs, authentication flows, uploads, administrative functions, and less common but legitimate requests. Monitoring provides evidence about false positives and unexpected policy interactions. Administrators can then tune the configuration before applying strict blocking to the entire production population. Immediate global enforcement can convert a minor configuration mistake into an application outage, while disabling logs removes the evidence needed to troubleshoot issues.

Question 140.

Which statement BEST describes mature FortiWeb administration?

1. Configure signatures once and never revisit them
2. Rely only on source IP reputation
3. Disable monitoring after deployment
4. Continuously manage application behavior, layered protections, logs, backend availability, certificates, exceptions, and policy tuning**

Correct Answer: 4. Continuously manage application behavior, layered protections, logs, backend availability, certificates, exceptions, and policy tuning

Explanation:

A mature FortiWeb deployment requires continuous administration because applications and threats change over time. Administrators should maintain backend pools and health checks, monitor logs, update certificates, tune attack signatures and behavioral protections, review exceptions, and adjust access controls as applications evolve. New releases may introduce APIs, methods, parameters, or workflows that require policy changes. Obsolete URLs and exceptions should be removed when no longer needed. Ongoing monitoring and tuning keep FortiWeb aligned with legitimate application behavior while maintaining strong security against current threats.