View Full Fortinet NSE5_FWB_AD-8.0 Exam Dumps and Practice Test Dumps

 

Question 21. An administrator is configuring FortiWeb to protect an application hosted on two backend servers. Which configuration is required to identify the backend destinations that FortiWeb can forward traffic to?

1. Bot detection profile
2. Server pool
3. Web cache policy
4. URL rewriting rule

Correct Answer: 2. Server pool

Explanation :-

A server pool identifies the backend servers that FortiWeb can use when processing client requests. A pool may contain multiple real servers, allowing FortiWeb to distribute traffic and provide application availability. The server pool is associated with the appropriate application delivery configuration and security policy so that permitted requests can reach the intended backend resources. Web caching is concerned with content delivery, URL rewriting modifies request handling, and bot detection evaluates automated traffic. When deploying FortiWeb as a reverse proxy, correctly defining the backend server pool is a fundamental configuration step because it establishes where protected application traffic can be forwarded after inspection.

Question 22. A FortiWeb administrator wants to ensure that a security policy applies only to requests destined for a specific protected application. Which configuration element should be used to identify the protected application or server?

1. Administrative access settings
2. Server policy matching criteria
3. System DNS
4. NTP configuration

Correct Answer: 2. Server policy matching criteria

Explanation :-

FortiWeb policies use matching criteria to determine which incoming requests should be processed by a particular policy. Depending on the deployment, these criteria can identify the protected server, application, protocol, source, or other relevant traffic characteristics. Proper policy matching prevents security rules from being applied too broadly or to the wrong application. System DNS and NTP provide infrastructure services, while administrative access controls management connectivity rather than application traffic matching. Administrators should review policy matching conditions carefully when multiple applications are protected by the same FortiWeb device, especially when those applications require different security profiles or backend destinations.

Question 23. A company wants FortiWeb to remain available if the primary appliance fails. Which FortiWeb capability should the administrator configure?

1. HTTP caching
2. High availability
3. URL rewriting
4. Web vulnerability scanning

Correct Answer: 2. High availability

Explanation :-

High availability allows FortiWeb appliances to operate together so that service can continue if one appliance becomes unavailable. HA is particularly important for applications that require continuous availability because a single security appliance can otherwise become a point of failure. FortiWeb HA configuration includes synchronization and failover-related behavior between cluster members. URL rewriting changes request processing, vulnerability scanning assesses application weaknesses, and HTTP caching improves content delivery. Administrators implementing HA should understand cluster roles, heartbeat communication, synchronization, and failover behavior so that application traffic continues to receive security inspection when an appliance failure occurs.

Question 24. An administrator needs FortiWeb to validate whether HTTP request parameters conform to expected application behavior rather than simply matching known attack signatures. Which protection approach is most relevant?

1. System backup
2. Data validation
3. Server health checking
4. DNS forwarding

Correct Answer: 2. Data validation

Explanation :-

Data validation allows FortiWeb to evaluate application input against expected characteristics and constraints. This can provide protection against malicious or unexpected input even when the traffic does not exactly match a conventional attack signature. Validation can be especially useful for applications with known parameter formats, permitted values, and expected request structures. DNS forwarding and server health checks serve infrastructure and availability functions, while system backup protects configuration data. Administrators should understand the application’s normal request patterns before applying restrictive validation rules because incorrectly defined validation requirements can result in false positives and block legitimate application transactions.

Question 25. A security administrator wants to detect malicious client-side scripts that could compromise users through a vulnerable web application. Which protection area should the administrator consider?

1. NTP synchronization
2. Static routing
3. Client-side security
4. Server load balancing

Correct Answer: 3. Client-side security

Explanation :-

Client-side security focuses on threats that affect users through content or scripts delivered by web applications. Modern applications can expose browsers to risks through compromised scripts, third-party resources, or manipulated client-side content. FortiWeb provides client-side security capabilities as part of its broader web application protection features. Server load balancing distributes traffic among backend systems, while NTP and routing provide supporting network services. Client-side security should be considered alongside server-side WAF protections because protecting the backend application alone does not necessarily address threats introduced through content delivered to the user’s browser.

Question 26. A FortiWeb administrator wants to reduce the impact of repeated requests for static content on backend application servers. Which feature can provide locally cached responses for eligible content?

1. Web vulnerability scanning
2. API discovery
3. HTTP caching
4. Bot mitigation

Correct Answer: 3. HTTP caching

Explanation :-

HTTP caching allows FortiWeb to retain eligible responses and serve subsequent requests from its cache rather than repeatedly retrieving the same content from the backend server. This can reduce backend processing and improve response performance for cacheable resources. Administrators must carefully consider cache-control behavior and whether content is public, personalized, authenticated, or otherwise sensitive. Bot mitigation controls automated traffic, API discovery identifies application interfaces, and vulnerability scanning evaluates application weaknesses. Proper caching configuration can improve application delivery, but caching inappropriate content could expose information or deliver stale responses, so cache rules should be designed according to application requirements.

Question 27. A web application uses several API endpoints, but the security team does not have an accurate inventory of those endpoints. What FortiWeb capability can help identify the APIs being used?

1. URL redirection
2. API discovery
3. SSL offloading
4. Server health checks

Correct Answer: 2. API discovery

Explanation :-

API discovery provides visibility into APIs used by protected applications. Maintaining an accurate API inventory is important because undocumented or forgotten endpoints can expand the application’s attack surface. Once APIs are identified, administrators can evaluate their behavior and apply appropriate protection and validation controls. Server health checks determine backend availability, SSL offloading handles TLS termination, and URL redirection changes client request destinations. API discovery is therefore an important first step in API security because administrators need visibility into the interfaces being exposed before they can effectively monitor, validate, and protect those interfaces.

Question 28. An organization wants FortiWeb to identify suspicious automated clients while allowing legitimate human users to continue accessing the application. Which capability should be evaluated?

1. Bot mitigation
2. Web vulnerability scanning
3. HTTP caching
4. URL rewriting

Correct Answer: 1. Bot mitigation

Explanation :-

Bot mitigation is designed to detect and control automated traffic interacting with web applications. Not all bots are malicious, so effective bot controls should distinguish between legitimate automated services and suspicious activity where possible. Malicious automation can be used for scraping, credential attacks, inventory abuse, and other forms of application abuse. HTTP caching addresses application delivery, URL rewriting transforms request handling, and vulnerability scanning tests for weaknesses. Administrators should tune bot mitigation carefully to avoid disrupting legitimate automated clients such as search engines, monitoring systems, or approved integrations.

Question 29. A FortiWeb deployment requires HTTPS traffic to be inspected while maintaining HTTPS communication with the backend servers. Which configuration concept supports this architecture?

1. HTTP caching only
2. Static routing
3. SSL offloading and re-encryption
4. DNS forwarding

Correct Answer: 3. SSL offloading and re-encryption

Explanation :-

FortiWeb can terminate the client-side SSL/TLS connection, decrypt the traffic for inspection, and establish another encrypted connection toward the backend server. This architecture allows FortiWeb to inspect application-layer content while maintaining encrypted communication between FortiWeb and the protected server. SSL offloading and re-encryption therefore provide an important option when organizations require both application inspection and encrypted backend communication. DNS forwarding and static routing do not perform TLS processing, while caching alone does not provide the required decryption and inspection capability. Certificate configuration and trust relationships must also be handled correctly for HTTPS deployments.

Question 30. A FortiWeb administrator observes that a backend server is responding slowly while other servers in the same pool remain healthy. Which feature can help FortiWeb determine whether a backend server should continue receiving traffic?

1. FortiAI
2. URL rewriting
3. Server health checks
4. API discovery

Correct Answer: 3. Server health checks

Explanation :-

Server health checks allow FortiWeb to periodically evaluate the availability and responsiveness of backend servers. Depending on the configured check and thresholds, FortiWeb can identify an unhealthy server and adjust traffic distribution accordingly. This helps prevent users from repeatedly being directed toward a backend that cannot properly serve requests. API discovery identifies application interfaces, URL rewriting modifies request paths, and FortiAI provides AI-assisted functionality. Health checks should be configured to reflect the actual service requirements of the application because an overly simple check might indicate that a server is available even when the specific application service is malfunctioning.

Question 31. A security team wants to prevent attackers from submitting unexpected values in application parameters. The team knows the permitted values and formats for those parameters. Which FortiWeb feature is most appropriate?

1. DNS forwarding
2. Server load balancing
3. Data validation
4. HTTP caching

Correct Answer: 3. Data validation

Explanation :-

Data validation allows FortiWeb to enforce expected characteristics for application input. When administrators know the acceptable formats, ranges, or values for parameters, validation can help reject unexpected input before it reaches the backend application. This provides an additional layer of protection against malformed or malicious requests. HTTP caching and server load balancing are application-delivery functions, while DNS forwarding provides name-resolution services. Effective validation depends on accurate knowledge of application behavior. Administrators should test validation rules against legitimate requests before enforcing them broadly to reduce the risk of false positives and application disruption.

Question 32. A company wants to use FortiWeb to identify vulnerabilities in an application before making it publicly accessible. Which feature should be used?

1. URL rewriting
2. Web vulnerability scan
3. Bot mitigation
4. Server load balancing

Correct Answer: 2. Web vulnerability scan

Explanation :-

A web vulnerability scan can assess a web application for known weaknesses and security issues. Performing testing before public deployment can help organizations identify vulnerabilities that should be corrected before the application is exposed to Internet traffic. Vulnerability scanning differs from WAF enforcement: a WAF primarily protects traffic at runtime, while scanning is intended to discover weaknesses in the application. Server load balancing distributes requests, bot mitigation manages automated clients, and URL rewriting modifies request handling. Administrators should conduct scans in an appropriate environment and review results carefully because testing can generate unusual or potentially disruptive requests.

Question 33. An administrator needs to configure FortiWeb to forward requests for a specific virtual host to the correct protected application. Which information is particularly useful for identifying the intended application?

1. The appliance serial number
2. The HTTP Host header or virtual host information
3. The NTP synchronization interval
4. The administrator’s password

Correct Answer: 2. The HTTP Host header or virtual host information

Explanation :-

Virtual hosting allows multiple web applications or domains to share infrastructure. The HTTP Host header can identify which hostname the client requested, allowing FortiWeb to distinguish between applications when appropriate policy and virtual-host configurations are used. This is particularly important when several domains are protected by the same FortiWeb appliance and require different backend destinations or security policies. Administrator credentials, NTP settings, and appliance serial numbers do not identify the web application requested by a client. Correct virtual-host configuration helps ensure that traffic reaches the intended application and receives the appropriate security controls.

Question 34. A FortiWeb administrator wants to protect an application from excessive connection attempts that could exhaust available resources. Which configuration area should be reviewed?

1. HTTP caching
2. DoS prevention
3. API discovery
4. URL rewriting

Correct Answer: 2. DoS prevention

Explanation :-

DoS prevention provides controls for detecting and limiting traffic patterns that can consume system or application resources. Excessive connection attempts, request rates, or other abnormal traffic can degrade availability even if the traffic does not contain a recognizable application-layer attack payload. Administrators should establish thresholds appropriate to the normal behavior of the protected application and monitor the results to avoid blocking legitimate traffic during normal usage spikes. API discovery identifies interfaces, URL rewriting changes request handling, and caching reduces repeated backend requests. DoS controls therefore form an important layer of availability protection alongside conventional web application security.

Question 35. A security administrator wants to send FortiWeb security events to an external logging system for centralized analysis. Which capability should be configured?

1. Server health checking
2. HTTP caching
3. Centralized logging
4. URL rewriting

Correct Answer: 3. Centralized logging

Explanation :-

Centralized logging allows security and operational events generated by FortiWeb to be forwarded to an external logging or analysis system. Centralized logs can improve visibility across multiple security devices and make it easier to correlate events during incident investigation. Administrators should configure the appropriate logging destination, event categories, and severity levels according to operational requirements. URL rewriting, server health checks, and HTTP caching perform application-processing functions rather than centralized event collection. Effective logging also requires consideration of storage capacity, retention requirements, time synchronization, and the volume of generated security events.

Question 36. An administrator is investigating why a FortiWeb security rule is generating false positives for legitimate requests. Which action should be taken before creating a broad exception?

1. Disable HTTPS for the application
2. Review the triggering condition and affected request details
3. Remove all backend servers
4. Disable every security profile

Correct Answer: 2. Review the triggering condition and affected request details

Explanation :-

False positives should be investigated by determining exactly which condition caused the request to be identified as suspicious. Reviewing the security event, matched rule, request characteristics, and affected application parameter can help the administrator determine whether the security control should be tuned or whether a narrowly scoped exception is appropriate. Disabling all security profiles would unnecessarily reduce protection, while removing backend servers or disabling HTTPS does not address the root cause. A precise exception or adjusted rule should be preferred over broad exclusions because broad exceptions can create security gaps and may allow genuinely malicious requests to bypass inspection.

Question 37. A company wants to maintain encrypted communication between clients and FortiWeb while also using FortiWeb to inspect the application traffic. Which component is essential for the client-side HTTPS connection?

1. A URL rewrite rule
2. A trusted SSL/TLS certificate and corresponding private key
3. A DHCP reservation
4. A server health-check script only

Correct Answer: 2. A trusted SSL/TLS certificate and corresponding private key

Explanation :-

When FortiWeb terminates an HTTPS connection from clients, it must present an appropriate SSL/TLS certificate and use the corresponding private key to establish the secure session. The certificate should represent the hostname being accessed and be trusted by the clients when required. Once the connection is terminated, FortiWeb can inspect the decrypted application traffic and apply security controls before forwarding it according to the configured architecture. DHCP reservations, health checks, and URL rewriting do not establish the client-side TLS session. Correct certificate configuration is therefore essential for secure HTTPS inspection and a reliable user experience.

Question 38. An administrator is troubleshooting an application that works when FortiWeb is bypassed but fails when traffic passes through FortiWeb. Which component should be checked as part of the investigation?

1. Only the NTP server name
2. Only the appliance hostname
3. FortiWeb policy processing and backend connectivity
4. Only the administrator’s desktop wallpaper

Correct Answer: 3. FortiWeb policy processing and backend connectivity

Explanation :-

If an application works when FortiWeb is bypassed but fails when traffic traverses FortiWeb, the investigation should focus on FortiWeb’s processing path. Administrators should verify policy matching, security profiles, SSL/TLS configuration, server pool settings, routing, backend connectivity, and relevant logs. The objective is to identify where the request or response is being altered, blocked, or interrupted. Checking unrelated settings such as a desktop wallpaper or hostname does not isolate an application traffic problem. A systematic comparison between direct and FortiWeb-mediated traffic can help determine whether the issue originates from security enforcement, proxy behavior, connectivity, or backend communication.

Question 39. A FortiWeb administrator wants to use artificial intelligence capabilities to assist with security operations and analysis. Which Fortinet technology should be considered?

1. Server health checks
2. URL rewriting
3. FortiAI
4. HTTP caching

Correct Answer: 3. FortiAI

Explanation :-

FortiAI provides AI-assisted capabilities within the Fortinet security ecosystem and is included among the FortiWeb 8.0 administration topics. It can assist administrators with certain security and operational tasks, depending on the supported FortiWeb functionality and deployment. FortiAI does not replace fundamental security controls such as WAF policies, API protection, authentication, logging, or DoS prevention. HTTP caching is an application-delivery mechanism, server health checks monitor backend availability, and URL rewriting modifies request handling. Administrators should understand the specific capabilities available in their FortiWeb version and use AI assistance as a complement to established security processes.

Question 40. An organization is reviewing its web application security controls against commonly recognized security guidance. Which two areas are directly relevant to this review?

1. SNMP and DNS
2. NTP and DHCP
3. BGP and OSPF
4. PCI DSS and OWASP

Correct Answer: 4. PCI DSS and OWASP

Explanation :-

PCI DSS and OWASP are both relevant to web application security and compliance considerations. PCI DSS provides requirements for organizations handling payment card data, while OWASP provides widely used application security guidance and resources addressing common web security risks. FortiWeb can contribute to a broader security and compliance architecture, but a WAF alone does not guarantee compliance with any standard. Organizations should evaluate all applicable requirements, including secure development, access control, vulnerability management, monitoring, and data protection. BGP, OSPF, NTP, DHCP, SNMP, and DNS are important networking technologies but are not themselves the primary frameworks identified for this application-security review.