View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 141.

A FortiWeb administrator wants to protect an application while keeping backend server addresses hidden from internet clients. Which architecture is MOST appropriate?

1. Reverse proxy deployment
2. Offline log collection only
3. DNS caching mode
4. Layer 2 switching mode

Correct Answer: 1. Reverse proxy deployment

Explanation:

In reverse proxy mode, internet clients connect to FortiWeb instead of directly reaching the backend web servers. FortiWeb receives the client request, applies security inspection and policy, and then establishes a separate connection to the protected application servers. This provides strong separation between public-facing access and internal infrastructure and naturally prevents clients from seeing the backend server addresses directly. Reverse proxy mode also supports functions such as TLS termination, backend re-encryption, load balancing, health checks, authentication integration, and application-layer security inspection. It is generally the most feature-rich deployment model when architectural changes are acceptable.

Question 142.

A server pool member begins returning application errors even though the server is still reachable by ping. What should the administrator configure?

1. Disable all health checks
2. An application-aware HTTP or HTTPS health check
3. A larger IP reputation database
4. A broader signature exception

Correct Answer: 2. An application-aware HTTP or HTTPS health check

Explanation:

Network reachability does not prove that the application itself is healthy. A server can answer ping or accept TCP connections while the web application is failing internally. An application-aware health check can request a specific URL and validate a response code, content string, or other expected condition. If the expected application response is missing, FortiWeb can mark the server unhealthy and stop sending new requests to it. This improves availability and prevents users from being directed to a server that is technically online but unable to provide the required service.

Question 143.

A stateful application uses local session storage on each backend server. Which FortiWeb capability helps maintain user continuity?

1. IP reputation
2. Data leak prevention
3. Session persistence
4. Signature suppression

Correct Answer: 3. Session persistence

Explanation:

Session persistence, sometimes called stickiness, keeps a client or application session associated with the same backend server. This is important when session state is stored locally and is not shared between backend systems. Without persistence, load balancing could send successive requests to different servers, causing users to lose authentication state or application context. The administrator should choose a persistence mechanism that matches how the application tracks sessions. Persistence is primarily an application-delivery feature and should be configured alongside health checks and load balancing where needed.

Question 144.

FortiWeb decrypts incoming HTTPS traffic, inspects it, and then forwards it to the backend using HTTPS. What is this design accomplishing?

1. Disabling SSL inspection
2. Removing the need for certificates
3. Preventing load balancing
4. Preserving encryption on both connection legs while allowing WAF inspection**

Correct Answer: 4. Preserving encryption on both connection legs while allowing WAF inspection

Explanation:

FortiWeb can terminate the client-side TLS session so that it can inspect the HTTP request and enforce application security controls. After inspection, it can create a separate TLS session toward the backend server. This preserves confidentiality between the client and FortiWeb as well as between FortiWeb and the application server. This design is useful where internal traffic must remain encrypted for security or compliance reasons. Proper certificate trust and validation should be configured on the backend connection so the encryption also provides meaningful server authentication.

Question 145.

An API should never receive requests larger than 2 MB. Which FortiWeb control BEST enforces this requirement?

1. Configure a maximum request-size limit that reflects legitimate API behavior
2. Allow unlimited request sizes
3. Disable HTTP inspection
4. Increase load-balancing weight

Correct Answer: 1. Configure a maximum request-size limit that reflects legitimate API behavior

Explanation:

A request-size limit can enforce expected application behavior and reject unusually large requests before they reach the backend. This can help reduce resource-exhaustion attacks, malformed payload abuse, or requests that clearly fall outside the application’s intended use. Administrators should configure the threshold with enough tolerance for legitimate traffic and test it before strict enforcement. Request-size limits are part of protocol validation and work best when combined with rate limiting, signatures, behavioral protection, and secure API design.

Question 146.

A web application uses GET, POST, and OPTIONS but never uses TRACE. Which policy is MOST appropriate?

1. Allow every method for compatibility
2. Permit required methods and block TRACE
3. Convert TRACE to GET
4. Disable method inspection

Correct Answer: 2. Permit required methods and block TRACE

Explanation:

Allowing only methods actually required by the application reduces unnecessary functionality and supports least-functionality principles. If GET, POST, and OPTIONS are legitimate but TRACE is not used, TRACE should generally be blocked. Administrators should confirm all application and API workflows before enforcing restrictions because some integrations may use less common methods. Method filtering should complement proper authorization, attack signatures, behavioral analysis, and secure coding. It reduces exposure but does not replace application-side security.

Question 147.

Which FortiWeb feature is designed to detect known SQL injection, cross-site scripting, and file inclusion payloads?

1. Load balancing
2. Health monitoring
3. Web attack signatures
4. Session persistence

Correct Answer: 3. Web attack signatures

Explanation:

Web attack signatures identify known malicious patterns in HTTP and HTTPS traffic. They can detect common application-layer attacks such as SQL injection, cross-site scripting, command injection, and file inclusion. When a signature matches, FortiWeb can log, alert, or block the request according to policy. Signature-based protection is a core WAF capability but should not be used alone. Behavioral analysis, protocol validation, bot mitigation, access control, and secure application development all contribute to a stronger layered defense.

Question 148.

One valid JSON parameter repeatedly triggers a FortiWeb signature. What is the BEST response after confirming the requests are legitimate?

1. Disable FortiWeb completely
2. Turn off all signatures
3. Exempt the entire API
4. Create a narrowly scoped signature exception for the specific parameter**

Correct Answer: 4. Create a narrowly scoped signature exception for the specific parameter

Explanation:

False positives should be resolved with the most precise exception possible. The administrator should identify the specific API endpoint, parameter, and signature involved and create an exception only for that legitimate case. This allows other application traffic to remain protected by the same signature. Broadly disabling signatures or exempting an entire API creates unnecessary security exposure. Exceptions should also be documented and reviewed periodically because future application changes may eliminate the need for the exception or alter the associated risk.

Question 149.

What is a major benefit of using FortiWeb behavioral protection in addition to signatures?

1. It can detect unusual application behavior that may not match known attack patterns
2. It removes the need for authentication
3. It automatically updates application code
4. It guarantees no false positives

Correct Answer: 1. It can detect unusual application behavior that may not match known attack patterns

Explanation:

Behavioral protection can learn what normal application requests look like and identify deviations that may indicate previously unseen or customized attacks. This complements signature-based detection, which focuses primarily on known malicious patterns. The behavioral model should be trained using representative legitimate traffic and tuned before strong enforcement. It does not eliminate the need for secure coding, authentication, signatures, or logging, and it cannot guarantee perfect accuracy. Its strength comes from adding anomaly-based detection to a layered application security strategy.

Question 150.

What should an administrator do before changing a FortiWeb behavioral policy from monitoring to blocking?

1. Disable attack logging
2. Validate that the learned model represents normal application traffic
3. Delete all server pools
4. Remove TLS certificates

Correct Answer: 2. Validate that the learned model represents normal application traffic

Explanation:

Behavioral models need representative traffic before they can reliably distinguish legitimate behavior from anomalies. Administrators should review detected deviations and confirm that common workflows, APIs, administrative tasks, scheduled activity, and unusual but valid requests are included in the learned baseline. Enabling blocking too early can create false positives and disrupt legitimate users. A staged process of learning, monitoring, tuning, and then blocking provides better accuracy and reduces operational risk. Logging should remain enabled throughout the process to support validation.

Question 151.

A public login endpoint is under automated credential-stuffing attack. Which FortiWeb controls are MOST relevant?

1. Bot mitigation and rate limiting
2. Static routing and DNS forwarding
3. Session persistence only
4. Load balancing only

Correct Answer: 1. Bot mitigation and rate limiting

Explanation:

Credential stuffing relies on automated tools that repeatedly attempt username and password combinations. Bot mitigation helps identify suspicious automation, while rate limiting can reduce excessive request frequency against the login endpoint. Administrators should tune thresholds carefully so legitimate users behind NAT or proxy infrastructure are not unfairly blocked. These controls are strongest when paired with multifactor authentication, account monitoring, secure password practices, and appropriate application-side authentication protections. Load balancing simply distributes requests and does not address the abusive behavior itself.

Question 152.

A sensitive application path should be accessible only from a corporate VPN address range. Which FortiWeb control BEST supports this requirement?

1. Increase request-body limits
2. Apply source-based access control to the protected URL
3. Disable HTTPS
4. Configure broader persistence

Correct Answer: 2. Apply source-based access control to the protected URL

Explanation:

Source-based access control can restrict a particular application path so that only requests from approved VPN address ranges are accepted. This reduces external exposure of sensitive or administrative resources. The application should still require strong authentication because source IP alone is not a complete identity mechanism. Administrators should ensure the allowed ranges accurately reflect legitimate VPN users and remote administrators. This control is directly aligned with restricting who can reach the protected URL and is more appropriate than changing unrelated protocol or persistence settings.

Question 153.

An organization wants to block an obsolete /legacy URL that is still present on the backend. Which FortiWeb feature is MOST suitable?

1. Server persistence
2. Health checking
3. URL access rules
4. TLS offloading

Correct Answer: 3. URL access rules

Explanation:

URL access rules allow administrators to permit or deny requests to specific application paths. If /legacy should no longer be reachable, FortiWeb can reject requests to that URL even while the backend resource still exists. This reduces attack surface and helps enforce the intended public application interface. Administrators should monitor logs for requests to the retired path because continued attempts may indicate old clients or reconnaissance. The backend functionality should ultimately be removed so the WAF is not the only mechanism preventing access.

Question 154.

A web application returns sensitive personal data in an error response. Which FortiWeb feature is MOST relevant for detecting this exposure?

1. Session persistence
2. Load balancing
3. Server health checking
4. Data leak prevention**

Correct Answer: 4. Data leak prevention

Explanation:

Data leak prevention can inspect web responses for patterns associated with sensitive information. This can help detect accidental exposure through error pages, API responses, or poorly designed application output. Depending on configuration, FortiWeb may log, alert, mask, or otherwise handle the detected information. DLP should be carefully tuned to avoid false positives and should complement secure error handling, proper authorization, and data minimization in the application. The strongest long-term fix is to prevent unnecessary sensitive data from being returned by the application in the first place.

Question 155.

A file upload page should accept only PDF files smaller than 8 MB. Which FortiWeb policy is BEST?

1. Restrict uploads to the required file type and size
2. Allow all file extensions
3. Disable request inspection
4. Increase server pool capacity

Correct Answer: 1. Restrict uploads to the required file type and size

Explanation:

Upload security should reflect the actual business requirement. If the application needs only PDF files up to 8 MB, FortiWeb should enforce appropriate file-type and size restrictions. This reduces the chance of executable, script, oversized, or unrelated content reaching the application. Malware-related inspection can provide another layer where supported. The backend application should independently validate files and store them securely. An allowlist-oriented policy is generally safer than accepting every format and attempting to identify dangerous content afterward.

Question 156.

Why should IP reputation be combined with other FortiWeb security controls?

1. Reputation cannot work with TLS
2. Source addresses may change, be shared, or provide incomplete information about request intent
3. IP reputation works only for internal users
4. Reputation disables machine learning

Correct Answer: 2. Source addresses may change, be shared, or provide incomplete information about request intent

Explanation:

IP reputation is valuable context but should not be treated as definitive proof that every request from a source is malicious or legitimate. Addresses may be dynamic, shared through proxies or NAT, or belong to cloud services used by many different parties. Attackers can also change infrastructure quickly. Combining reputation with signatures, behavioral protection, bot mitigation, authentication, protocol validation, and rate controls provides stronger and more resilient security. Layered controls reduce dependence on any single indicator and improve both detection accuracy and operational flexibility.

Question 157.

After an application upgrade, FortiWeb starts blocking a new legitimate parameter format. What should the administrator review FIRST?

1. FortiWeb event logs and the application’s new request behavior
2. Printer settings
3. Server rack location
4. Desktop wallpaper

Correct Answer: 1. FortiWeb event logs and the application’s new request behavior

Explanation:

Application upgrades often change URLs, parameters, methods, request-body formats, APIs, and workflows. Existing FortiWeb security policies may classify these new patterns as suspicious because they were not part of the previous application behavior. Reviewing the associated logs shows exactly which policy or signature triggered. Administrators can then compare the blocked requests with the application release changes and adjust exceptions, protocol limits, signatures, or behavioral models as needed. Broadly disabling protection should be avoided because the issue is usually localized to changed legitimate behavior.

Question 158.

A new API release introduces different JSON structures, causing behavioral protection to flag valid requests. What is the BEST response?

1. Permanently disable behavioral security
2. Retrain or retune the model using validated traffic from the new API version
3. Block every API request
4. Disable all logging

Correct Answer: 2. Retrain or retune the model using validated traffic from the new API version

Explanation:

Behavioral models are based on previously observed legitimate traffic. If an API changes significantly, valid new request structures may look anomalous compared with the old model. Administrators should confirm that the new traffic is legitimate and update the learning process so the model reflects current behavior. Monitoring should continue until the revised model is stable enough for blocking. This allows FortiWeb to preserve the value of anomaly detection while adapting to normal application evolution and reducing false positives.

Question 159.

A FortiWeb administrator is preparing a strict protection profile for a mission-critical application. Which rollout strategy is BEST?

1. Test with representative traffic, monitor, tune, and then expand enforcement
2. Enable maximum blocking for all users immediately
3. Disable logs during rollout
4. Bypass FortiWeb until the first attack occurs

Correct Answer: 1. Test with representative traffic, monitor, tune, and then expand enforcement

Explanation:

A staged rollout helps prevent minor tuning errors from becoming production outages. The administrator should test the policy against representative user workflows, APIs, authentication, uploads, administrative tasks, and less common legitimate behavior. Monitoring and logs can reveal false positives or unexpected policy interactions. After the configuration is validated, enforcement can be expanded with greater confidence. Immediate maximum blocking can disrupt legitimate users, while disabling logs removes the information needed to understand and correct problems.

Question 160.

Which statement BEST describes a mature FortiWeb operational approach?

1. Configure the WAF once and never change it
2. Use only signatures and ignore backend availability
3. Disable monitoring after deployment
4. Continuously review application changes, logs, protections, exceptions, certificates, backend health, and policy effectiveness**

Correct Answer: 4. Continuously review application changes, logs, protections, exceptions, certificates, backend health, and policy effectiveness

Explanation:

FortiWeb security is an ongoing lifecycle because applications, APIs, certificates, traffic patterns, backend systems, and threats continually evolve. Administrators should monitor attack and traffic logs, maintain backend health checks and server pools, review exceptions, update certificates, tune behavioral models, and adjust security profiles when application releases introduce new behavior. Obsolete URLs and exceptions should be removed when no longer needed. Continuous review helps keep protection aligned with legitimate application use while reducing false positives and closing security gaps that can emerge over time.