View Full Fortinet NSE5_FWB_AD-8.0 Exam Dumps and Practice Test Dumps

 

Question 81. A FortiWeb administrator needs to protect an application from clients sending unusually large HTTP request bodies. Which FortiWeb capability should be configured to enforce an upper request-size limit?

1. Web Application Firewall signature action
2. HTTP request body size restriction
3. Server health check interval
4. HTTP caching policy

Correct Answer: 2. HTTP request body size restriction

Explanation :-

A request body size restriction limits how much data a client can submit in an HTTP request. This is useful for preventing oversized requests from consuming excessive resources or bypassing application assumptions about expected input sizes. FortiWeb can apply request-size controls as part of its web application protection configuration. WAF signatures may detect specific malicious patterns, but they are not the primary mechanism for enforcing a general maximum request-body size. Health checks monitor backend availability, while HTTP caching controls responses rather than request size. Administrators should choose a limit appropriate for the application so legitimate uploads and API requests are not unintentionally blocked.

Question 82. A company uses FortiWeb as a reverse proxy and wants users to access an application only through HTTPS. Which configuration should the administrator use to redirect HTTP requests to HTTPS?

1. URL redirection from HTTP to HTTPS
2. Server health checking
3. HTTP caching
4. Backend connection pooling

Correct Answer: 1. URL redirection from HTTP to HTTPS

Explanation :-

HTTP-to-HTTPS redirection allows FortiWeb to automatically send clients from an unencrypted HTTP URL to the corresponding HTTPS URL. This helps ensure that users access the application through an encrypted connection. It is particularly useful when an application is intended to operate securely but users may still enter or follow HTTP URLs. Health checks are designed to determine backend availability, while caching manages response reuse. Connection pooling concerns communication with backend servers. Redirecting clients to HTTPS is different from merely terminating TLS because the redirect first changes the client’s requested protocol. The administrator should also ensure that the appropriate certificate is configured for the HTTPS virtual server.

Question 83. A FortiWeb administrator wants to distribute client requests among several backend web servers while automatically removing an unavailable server from rotation. Which configuration provides this behavior?

1. Web vulnerability scan
2. HTTP method restriction
3. Server pool with health checks
4. URL access control

Correct Answer: 3. Server pool with health checks

Explanation :-

A server pool groups backend servers that can service requests for an application. FortiWeb can use health checks to periodically determine whether those servers are available. When a server fails its configured health-check criteria, FortiWeb can stop directing new traffic to that unhealthy member, depending on the configured load-balancing behavior. This improves application availability and prevents clients from repeatedly being sent to an unreachable backend. HTTP method restrictions and URL access controls protect application access, but they do not distribute traffic. Vulnerability scanning identifies security weaknesses rather than controlling production load distribution.

Question 84. An application accepts user-supplied search strings. An administrator wants FortiWeb to detect attempts to inject database commands through those parameters. Which protection is most directly applicable?

1. HTTP caching
2. SSL certificate validation
3. Server health monitoring
4. SQL injection protection

Correct Answer: 4. SQL injection protection

Explanation :-

SQL injection protection is designed to identify malicious input intended to manipulate database queries. Attackers may place SQL syntax into URL parameters, form fields, cookies, or other request components in an attempt to alter application behavior or access unauthorized information. FortiWeb’s WAF capabilities can inspect application traffic and apply SQL injection detection and enforcement. HTTP caching does not analyze malicious database syntax, while server health monitoring only evaluates backend availability. SSL certificate validation protects the communication channel and does not itself determine whether an application parameter contains an SQL injection attempt. Administrators should tune detection appropriately to reduce false positives for legitimate application input.

Question 85. A FortiWeb administrator observes that a legitimate API request is being blocked by a security rule. The administrator needs to determine exactly which rule triggered the block. What should be reviewed first?

1. The event or security log details
2. The backend server’s operating-system logs only
3. The DNS server configuration
4. The FortiWeb system clock settings

Correct Answer: 1. The event or security log details

Explanation :-

FortiWeb security and event logs provide important information for troubleshooting blocked requests. Depending on the configured logging and security feature, an event can identify the policy, signature, protection mechanism, or other condition associated with the action. Reviewing the event details allows an administrator to determine why the request was blocked before changing security settings. Looking only at backend operating-system logs may not reveal a request that FortiWeb rejected before forwarding it. DNS configuration and system clock settings can be relevant to other troubleshooting scenarios but do not normally identify the specific WAF control responsible for a blocked request.

Question 86. A web application requires users to maintain the same backend session during a login workflow. Which FortiWeb feature can help ensure that requests from the same client continue reaching the appropriate backend server?

1. Vulnerability scanning
2. Session persistence
3. URL rewriting
4. Geographic access control

Correct Answer: 2. Session persistence

Explanation :-

Session persistence, sometimes called sticky-session behavior, helps maintain continuity between a client and a particular backend server when multiple servers are available in a server pool. This can be important for applications that maintain session information locally on a backend server rather than storing it in a shared session store. Without persistence, subsequent requests may be distributed to different servers and the application could lose the expected session context. URL rewriting changes URLs or request behavior, while geographic access controls determine whether traffic from specified locations is permitted. Vulnerability scanning identifies security weaknesses rather than controlling which backend receives an established user’s requests.

Question 87. An organization wants FortiWeb to inspect uploaded files and block malicious files before they reach its web servers. Which capability should the administrator consider?

1. HTTP caching
2. DNS filtering
3. Antivirus scanning
4. Server load-balancing persistence

Correct Answer: 3. Antivirus scanning

Explanation :-

Antivirus scanning can inspect files transferred through web applications and help detect malicious content before it reaches backend systems. This is particularly relevant for applications that allow users to upload documents, images, archives, or other files. The administrator should configure the relevant file-inspection and security policies according to the application’s legitimate upload requirements. HTTP caching does not inspect uploaded files for malware. DNS filtering operates at the domain-resolution level, and session persistence determines backend routing behavior. File inspection should be tested carefully because legitimate file formats and sizes vary considerably between applications, and overly restrictive policies can interfere with normal business workflows.

Question 88. A security team wants to restrict access to an administrative URL so that only requests matching an approved source IP range can reach it. Which FortiWeb feature is most appropriate?

1. URL access control combined with IP-based access restrictions
2. HTTP response caching
3. Backend health checking
4. SSL certificate renewal

Correct Answer: 1. URL access control combined with IP-based access restrictions

Explanation :-

URL access control can identify and enforce rules for specific application paths, while IP-based restrictions can limit which source addresses are permitted to access protected resources. Combining these controls is useful for sensitive administrative URLs that should not be publicly accessible. For example, an administrator can create a rule that identifies the administrative path and permits only traffic from approved management networks. HTTP caching does not provide source-address authorization, health checks monitor backend servers, and certificate renewal manages TLS credentials. The exact policy structure should be aligned with FortiWeb’s processing order and the application’s URL patterns so that legitimate management traffic remains accessible.

Question 89. A FortiWeb deployment terminates TLS connections from clients but the organization also requires encrypted communication between FortiWeb and the backend web servers. Which design satisfies this requirement?

1. Disable TLS on both sides
2. Use HTTP caching between FortiWeb and the servers
3. Terminate client TLS and establish HTTPS connections to the backend
4. Use only a server health check

Correct Answer: 3. Terminate client TLS and establish HTTPS connections to the backend

Explanation :-

FortiWeb can terminate the client’s TLS connection, inspect and process the HTTP traffic, and then establish a separate encrypted HTTPS connection to the backend server. This approach provides encryption across both network segments while still allowing FortiWeb to perform security inspection at the proxy. The backend connection requires appropriate HTTPS configuration and certificate/trust handling. Simply disabling TLS would leave traffic unencrypted, while caching does not provide transport encryption. A health check can verify backend availability but does not secure application traffic. Administrators should ensure that the backend certificate requirements and trust relationships are correctly configured for the intended deployment.

Question 90. An administrator wants to prevent clients from using HTTP methods that an application never requires, such as TRACE or DELETE. Which FortiWeb control should be configured?

1. HTTP method restriction
2. Server health check
3. Web vulnerability scanner
4. Traffic logging only

Correct Answer: 1. HTTP method restriction

Explanation :-

HTTP method restrictions allow administrators to control which HTTP methods are permitted for an application or policy. Limiting methods to those actually required by the application reduces unnecessary attack surface and can prevent unexpected operations from reaching backend servers. For example, an application that requires only GET and POST may not need TRACE, DELETE, or other methods. A server health check has a different purpose: determining whether a backend is available. A vulnerability scanner evaluates application weaknesses, while logging records traffic or security events without necessarily blocking unwanted methods. Administrators should confirm the application’s legitimate method requirements before enforcing restrictive rules.

Question 91. A FortiWeb administrator needs to identify which backend server is receiving requests for a particular virtual host. Which configuration concept should be examined first?

1. Antivirus signature updates
2. Virtual server, host matching, and server policy configuration
3. HTTP caching timeout only
4. Client browser history

Correct Answer: 2. Virtual server, host matching, and server policy configuration

Explanation :-

FortiWeb can use virtual server and server policy configurations to determine how incoming requests are associated with protected applications and backend resources. The HTTP Host header can be particularly important when multiple applications or domains share the same FortiWeb interface. Reviewing the virtual server, host matching, and associated server policy helps determine which configuration receives the request and which backend server pool is selected. Antivirus updates are unrelated to request routing. Browser history does not determine FortiWeb’s policy matching, and cache settings do not generally establish which backend server a policy targets.

Question 92. A company wants FortiWeb to detect automated clients attempting to abuse a login page with large numbers of requests. Which capability is most relevant?

1. Bot management and mitigation
2. HTTP response compression
3. TLS certificate generation only
4. Backend DNS resolution

Correct Answer: 1. Bot management and mitigation

Explanation :-

Bot management and mitigation capabilities are designed to help identify and control automated traffic. Automated abuse of login pages can involve credential attacks, excessive requests, scraping, or other unwanted behavior. FortiWeb can apply bot-related detection and enforcement mechanisms to distinguish potentially automated clients from legitimate users, depending on the configured protection approach. Response compression changes how content is transmitted and does not identify abusive automation. Certificate generation establishes cryptographic credentials, while DNS resolution supports name resolution rather than bot detection. Administrators should tune bot controls according to the application’s legitimate automated clients, such as trusted APIs, monitoring systems, or business integrations.

Question 93. An administrator needs to forward FortiWeb security events to a centralized logging platform for correlation with logs from other security devices. Which approach is appropriate?

1. Disable local logging
2. Configure centralized log forwarding
3. Increase the backend health-check frequency
4. Enable HTTP caching

Correct Answer: 2. Configure centralized log forwarding

Explanation :-

Centralized log forwarding allows FortiWeb events and relevant operational information to be sent to an external logging or security-analysis platform. Centralizing logs can help security teams correlate events across multiple devices and investigate incidents using information from different network components. Local logging may still be retained depending on the organization’s requirements, so forwarding does not necessarily require disabling local logs. Backend health-check frequency affects server monitoring and has no direct relationship to log aggregation. HTTP caching controls application response handling. Administrators should select appropriate event categories, severity levels, transport settings, and destination configuration based on the organization’s logging architecture.

Question 94. A web application is experiencing repeated requests that attempt to execute operating-system commands through an input parameter. Which WAF protection should the administrator investigate?

1. Command injection protection
2. Session persistence
3. HTTP caching
4. Server pool load balancing

Correct Answer: 1. Command injection protection

Explanation :-

Command injection attacks attempt to manipulate application input so that unintended operating-system commands are executed by the server. A WAF can inspect request parameters and apply command-injection detection and enforcement mechanisms. This protection is different from SQL injection protection, which focuses on manipulating database queries. Session persistence and load balancing determine how requests are routed, while HTTP caching manages responses. Administrators should investigate the relevant security event details when command-injection protection blocks legitimate requests because applications may legitimately accept characters that resemble command syntax. Appropriate tuning should preserve legitimate functionality while maintaining protection against malicious input.

Question 95. An administrator wants to use FortiWeb to identify vulnerabilities in a web application before attackers exploit them. Which feature is designed specifically for this purpose?

1. Server load balancing
2. Web vulnerability scanning
3. HTTP method redirection
4. Session persistence

Correct Answer: 2. Web vulnerability scanning

Explanation :-

Web vulnerability scanning is intended to identify weaknesses in web applications and associated web resources. It can help security teams discover vulnerabilities that require remediation before they are exploited. This function differs from runtime WAF protection, which evaluates production traffic as requests are processed. Server load balancing distributes requests among backend servers, session persistence maintains client-to-server continuity, and HTTP redirection changes how clients access URLs. Administrators should conduct vulnerability assessments in an appropriate testing or controlled environment when possible and interpret scanner findings carefully. Identified vulnerabilities should be validated and remediated through the application’s development and security processes.

Question 96. A FortiWeb administrator wants to prevent clients from accessing an application from a list of prohibited countries or regions. Which security control is most directly applicable?

1. IP-based geographic access control
2. HTTP response caching
3. Server health check
4. TLS backend re-encryption

Correct Answer: 1. IP-based geographic access control

Explanation :-

Geographic access control can use the geographic information associated with client IP addresses to permit or deny traffic from specified countries or regions. This can be useful when an organization has legitimate geographic restrictions or wants to reduce exposure from locations that are outside its business requirements. The effectiveness of geographic filtering depends on the accuracy of IP geolocation data and should not be treated as a substitute for application authentication or other security controls. HTTP caching affects responses, health checks monitor backend availability, and TLS re-encryption protects traffic between FortiWeb and backend servers. Administrators should review legitimate users and business requirements before enforcing geographic restrictions.

Question 97. A FortiWeb policy is receiving legitimate requests, but users report intermittent failures because some backend servers have become unavailable. Which diagnostic area should the administrator inspect first?

1. Browser bookmarks
2. Server pool membership and health-check status
3. URL redirection rules only
4. Client-side browser cache

Correct Answer: 2. Server pool membership and health-check status

Explanation :-

When failures occur because some backend servers may be unavailable, the administrator should inspect the server pool and health-check status. A server pool determines which backend servers can receive traffic, while health checks provide information about whether those servers are responding as expected. If an unhealthy server remains eligible for traffic, clients can experience intermittent failures. Reviewing pool membership and health-check results can therefore help isolate whether the problem is related to backend availability or routing. Browser bookmarks and client cache are unlikely to explain server-specific failures, while URL redirection rules address request routing or URL behavior rather than backend server health.

Question 98. An organization wants to protect an API from unexpected request parameters and malformed input while also discovering the APIs being used by clients. Which FortiWeb capabilities should the administrator consider?

1. API discovery and API protection
2. HTTP caching and compression
3. Server health checks only
4. Geographic filtering only

Correct Answer: 1. API discovery and API protection

Explanation :-

API discovery can help administrators identify APIs and understand the application’s API exposure, while API protection can enforce security controls around API requests. These capabilities are useful when an organization needs visibility into API endpoints and wants to restrict unexpected or malformed requests. API security can include validation of request structures, parameters, methods, and other characteristics depending on the configured FortiWeb functionality. HTTP caching and compression address application delivery rather than API security. Health checks determine backend availability, and geographic filtering restricts traffic based on source location. Effective API protection should be aligned with documented application behavior so legitimate clients are not unnecessarily blocked.

Question 99. A security administrator needs to reduce the impact of excessive requests against a web application without completely blocking all traffic. Which FortiWeb capability is most relevant?

1. TLS certificate management
2. URL rewriting
3. Rate limiting
4. Web application authentication only

Correct Answer: 3. Rate limiting

Explanation :-

Rate limiting controls how frequently requests can be accepted from clients or according to defined traffic conditions. It can help reduce resource exhaustion caused by excessive request rates while allowing legitimate traffic to continue. This makes it useful for applications that need protection from request floods, abusive clients, or unusually high traffic volumes. TLS certificate management establishes secure communication credentials but does not control request volume. URL rewriting changes request destinations or formats, while authentication determines whether a user can access an application. Rate limits should be selected based on normal application behavior so legitimate bursts are not unnecessarily blocked.

Question 100. A FortiWeb administrator is investigating why a security policy does not appear to affect a particular request. Which sequence provides the most useful initial troubleshooting approach?

1. Immediately disable all WAF protections and restart every backend server
2. Replace all certificates before reviewing the policy
3. Review request matching, virtual host/server policy association, logs, and the relevant security rule
4. Delete the server pool and recreate it without checking logs

Correct Answer: 3. Review request matching, virtual host/server policy association, logs, and the relevant security rule

Explanation :-

A systematic troubleshooting process should begin by determining whether the request is reaching the expected virtual host and server policy, whether the policy matches the request characteristics, and what the logs report. Reviewing the relevant security rule can then show whether the expected protection is enabled and whether another rule or processing condition is responsible for the observed behavior. Immediately disabling protections can reduce security without identifying the cause. Replacing certificates is unrelated unless TLS negotiation is actually failing, and recreating server pools without evidence can introduce additional configuration problems. A structured review of matching, policy association, logs, and security rules provides a more reliable starting point.