View Full Fortinet NSE5_FWB_AD-8.0 Exam Dumps and Practice Test Dumps

 

Question 241. Which FortiWeb deployment mode is designed to operate transparently at the network layer without requiring changes to the existing IP addressing scheme?

1. Reverse proxy
2. Transparent bridge
3. Offline protection
4. WCCP integration

Correct Answer: 2. Transparent bridge

Explanation :-

Transparent bridge mode allows FortiWeb to be inserted into an existing network path while remaining transparent to the connected devices. It can inspect and protect traffic without requiring the same type of addressing changes associated with a routed or reverse-proxy deployment. This makes it useful when an organization wants to introduce web application security with minimal changes to the current network topology. Reverse proxy mode instead uses virtual servers and server policies to proxy client connections. Offline protection is intended for traffic monitoring or out-of-band scenarios rather than inline enforcement. Therefore, transparent bridge mode is the appropriate choice when network-layer transparency is required.

Question 242. A FortiWeb administrator needs to distribute incoming requests across several healthy backend web servers. Which FortiWeb component defines the collection of backend servers used for this purpose?

1. Server pool
2. Web application firewall profile
3. Authentication rule
4. URL rewriting policy

Correct Answer: 1. Server pool

Explanation :-

A server pool groups backend real servers that FortiWeb can use to service client requests. The server pool works with the virtual server and service configuration to provide application delivery and load-balancing functionality. Health checks can determine whether individual real servers are available before requests are forwarded. A WAF profile provides security inspection rather than backend server selection. Authentication rules control access to protected resources, while URL rewriting modifies request or response URLs. When a FortiWeb policy must distribute requests among multiple backend web servers, configuring the appropriate real servers in a server pool is therefore a fundamental part of the deployment.

Question 243. Which FortiWeb feature can detect abnormal application behavior by learning normal input patterns and using machine-learning models to identify anomalies?

1. IP reputation
2. Static URL filter
3. Machine-learning anomaly detection
4. DNS server configuration

Correct Answer: 3. Machine-learning anomaly detection

Explanation :-

FortiWeb can use machine-learning-based anomaly detection to establish models of expected application behavior and identify inputs that deviate from learned patterns. This approach is useful for detecting unusual application requests that may not be adequately identified by simple signature matching. Machine-learning detection can evaluate behavioral characteristics and combine model results when determining whether traffic appears anomalous. IP reputation focuses on the reputation of source addresses, while static URL filtering evaluates configured URL conditions. DNS configuration does not provide application-layer anomaly analysis. Administrators should understand that anomaly detection is intended to complement other security controls rather than replace conventional WAF protections.

Question 244. An administrator wants FortiWeb to terminate an HTTPS connection, inspect the decrypted request, and forward the request to a backend server using HTTP. Which feature should be configured?

1. Passive SSL inspection
2. SSL offloading
3. HTTP compression
4. URL rewriting

Correct Answer: 2. SSL offloading

Explanation :-

SSL offloading allows FortiWeb to terminate the client’s HTTPS connection and perform inspection on the decrypted HTTP traffic. When configured appropriately, FortiWeb can then forward the request to the backend server over HTTP. This architecture places certificate handling and the initial TLS termination on FortiWeb, allowing security policies to inspect the application-layer content. Passive inspection does not provide the same active TLS termination behavior. HTTP compression concerns content-transfer efficiency, while URL rewriting changes URL information rather than handling TLS termination. SSL offloading is therefore the feature that directly supports decrypting client HTTPS traffic and forwarding the resulting cleartext request to a backend server.

Question 245. A company wants FortiWeb to identify automated clients that repeatedly retrieve large numbers of pages for the purpose of extracting website content. Which protection is most relevant?

1. Content scraping detection
2. Certificate validation
3. HTTP compression
4. Static route filtering

Correct Answer: 1. Content scraping detection

Explanation :-

Content scraping detection is designed to identify automated clients that systematically access website content at a rate or pattern associated with scraping. Such activity can consume application resources and may expose valuable business content to automated collection. FortiWeb can use behavioral indicators and threshold-based detection to identify suspicious scraping activity. Certificate validation is concerned with TLS identity and trust. HTTP compression optimizes content transfer but does not identify malicious automation, and static route filtering operates at the network-routing level. When the security requirement specifically involves detecting automated clients that systematically retrieve website pages, content scraping detection is the relevant FortiWeb capability.

Question 246. Which FortiWeb configuration object determines the security controls applied to HTTP or HTTPS requests after traffic reaches a protected application?

1. DNS zone
2. Server policy
3. System certificate store
4. Administrative user group

Correct Answer: 2. Server policy

Explanation :-

A FortiWeb server policy associates incoming application traffic with the appropriate virtual server, backend resources, and security profiles. It provides the framework through which FortiWeb applies protection to traffic destined for a published web application. Depending on the configuration, a policy can reference WAF profiles, authentication mechanisms, DoS protections, and other security controls. A DNS zone is not the primary object responsible for enforcing application security. The certificate store manages certificates and keys, while administrative user groups control administrator permissions. Therefore, when determining where application traffic protection is applied within a FortiWeb deployment, the server policy is a central configuration object.

Question 247. A security team wants FortiWeb to restrict access to an administrative web portal so that only requests originating from approved corporate IP ranges are accepted. Which feature should be used?

1. HTTP body length constraint
2. Cookie security
3. IP-based access control
4. URL compression

Correct Answer: 3. IP-based access control

Explanation :-

IP-based access control allows administrators to define which source IP addresses or networks are permitted or denied when accessing protected applications. For an administrative portal that should only be reachable from approved corporate ranges, an IP list or equivalent IP-based access-control mechanism can enforce that restriction before normal application access is granted. HTTP body length constraints are intended to control request size, while cookie security protects cookies against certain manipulation or abuse. URL compression does not provide source-address access control. This makes IP-based access control the appropriate mechanism for restricting an administrative web application to explicitly approved corporate network ranges.

Question 248. Which authentication method allows FortiWeb site publishing to delegate user authentication to an external identity provider using the SAML protocol?

1. HTML authentication
2. Basic authentication
3. Local password authentication
4. SAML authentication

Correct Answer: 4. SAML authentication

Explanation :-

SAML authentication enables FortiWeb to integrate application access with an external identity provider. Instead of requiring FortiWeb to independently manage the user’s application credentials, authentication can be delegated through the SAML trust relationship established between the service provider and identity provider. This is useful in environments using centralized identity and single sign-on services. HTML authentication is another authentication mechanism but does not represent the SAML federation process. Basic authentication uses HTTP authentication credentials and is conceptually different from federated SAML authentication. Therefore, when a requirement specifically calls for external identity-provider authentication using the SAML protocol, SAML authentication is the appropriate choice.

Question 249. A FortiWeb administrator wants to limit a particular user group to 50 API requests per minute. Which control should be configured?

1. Group-based rate limiting
2. Certificate revocation
3. URL rewriting
4. Static content caching

Correct Answer: 1. Group-based rate limiting

Explanation :-

Group-based rate limiting can control how many requests members of a defined user group may generate during a specified period. This is particularly useful for APIs where authenticated users or groups have different consumption limits. For example, if group B is permitted 50 requests per minute, the administrator can configure a rate limit that enforces that threshold for the group. Certificate revocation addresses certificate trust rather than request volume. URL rewriting changes URL structures, while static content caching improves delivery efficiency. Rate limiting therefore directly addresses excessive request volume and can help prevent abuse or resource exhaustion by enforcing a defined request threshold.

Question 250. Which FortiWeb capability is most directly associated with identifying and protecting exposed API endpoints and enforcing API-specific security controls?

1. API protection
2. Network interface bonding
3. DNS forwarding
4. System backup

Correct Answer: 1. API protection

Explanation :-

API protection provides security controls specifically designed for application programming interfaces. APIs often expose structured endpoints that require controls beyond traditional browser-oriented web security. FortiWeb can use API-related discovery and protection capabilities to identify API behavior and enforce appropriate policies. Network interface bonding provides network resilience or increased link capacity but does not analyze API requests. DNS forwarding handles name-resolution traffic, and system backup protects configuration or system state. When an organization needs to identify API endpoints and apply API-specific security controls, API protection is the relevant FortiWeb capability.

Question 251. An administrator wants FortiWeb to protect applications from malformed or unexpected HTTP requests before those requests are processed by backend servers. Which security capability is most relevant?

1. HTTP protocol constraints
2. Static routing
3. Certificate import
4. Session synchronization

Correct Answer: 1. HTTP protocol constraints

Explanation :-

HTTP protocol constraints can enforce expected characteristics of HTTP requests and help identify malformed, invalid, or unexpected protocol behavior. Such validation is an important layer of web application protection because attackers may deliberately construct unusual requests to exploit application weaknesses or evade security controls. Static routing determines packet forwarding and does not validate HTTP syntax. Certificate import manages cryptographic credentials, while session synchronization is associated with maintaining state between systems or HA members. Applying protocol validation allows FortiWeb to reject requests that violate configured expectations before they are passed to backend applications, reducing exposure to malformed-request attacks and protocol-level abuse.

Question 252. A FortiWeb administrator needs to ensure that a backend server is removed from load balancing when it becomes unavailable. Which configuration should be used?

1. URL rewriting rule
2. Server health check
3. Cookie security profile
4. Administrative profile

Correct Answer: 2. Server health check

Explanation :-

A server health check allows FortiWeb to monitor the availability and responsiveness of backend real servers. When a server fails the configured health-check criteria, FortiWeb can recognize that the server is unavailable and avoid directing new client requests to it. This prevents traffic from being unnecessarily sent to an unhealthy application instance. URL rewriting changes URLs, cookie security protects session cookies, and administrative profiles define administrator permissions. Health checks are therefore a key component of reliable load-balanced application delivery because they provide FortiWeb with information about the operational status of backend servers.

Question 253. Which FortiWeb feature is intended to help mitigate application-layer denial-of-service attacks by tracking client request behavior?

1. Client management
2. Certificate signing request
3. DNS cache
4. Static file compression

Correct Answer: 1. Client management

Explanation :-

Client management provides mechanisms for tracking client behavior and maintaining information that can be used by FortiWeb security features. Application-layer DoS protections may depend on identifying request patterns associated with individual clients so that abnormal activity can be detected and controlled. Certificate signing requests are used to obtain certificates from certificate authorities, while DNS caching improves name-resolution performance. Static file compression reduces content size but does not track application request behavior. Client management is therefore relevant when a security policy needs to monitor client activity and apply controls based on request behavior, particularly in scenarios involving excessive or suspicious application-layer traffic.

Question 254. An organization wants to hide sensitive URL information from users and reduce exposure of internal URL structures. Which FortiWeb capability can modify URLs exchanged between clients and the application?

1. URL rewriting
2. Server health checking
3. IP reputation
4. HA heartbeat

Correct Answer: 1. URL rewriting

Explanation :-

URL rewriting allows FortiWeb to modify URLs in HTTP requests or responses according to configured rules. This can be useful when an organization needs to present a different public URL structure while mapping requests to internal application paths or when certain URL information should not be directly exposed. Server health checking determines whether backend servers are available. IP reputation evaluates the reputation of source addresses, and HA heartbeat mechanisms help maintain high-availability state between devices. URL rewriting therefore directly addresses requirements involving controlled modification of URL information as traffic passes through the FortiWeb application-delivery layer.

Question 255. Which FortiWeb feature can help identify known malicious source addresses based on reputation information?

1. IP reputation
2. HTTP compression
3. SSL offloading
4. Server pool

Correct Answer: 1. IP reputation

Explanation :-

IP reputation is used to evaluate source addresses against reputation information associated with potentially malicious or suspicious activity. This allows FortiWeb to apply security decisions based on the reputation of an originating IP address before or while processing application traffic. HTTP compression focuses on reducing the size of transferred content. SSL offloading terminates TLS connections and enables inspection of encrypted traffic, while a server pool identifies backend servers available for application delivery. IP reputation therefore provides a reputation-based security layer that can complement WAF rules, bot mitigation, access controls, and other application-security mechanisms.

Question 256. A FortiWeb administrator is configuring multiple HTTPS sites that require different certificates based on the hostname requested by clients. Which capability is particularly relevant?

1. SNI-based certificate selection
2. HTTP body compression
3. IP address aggregation
4. Static route redistribution

Correct Answer: 1. SNI-based certificate selection

Explanation :-

Server Name Indication, or SNI, allows the client to indicate the hostname it is attempting to access during the TLS handshake. FortiWeb can use that information to select the appropriate certificate when multiple HTTPS applications share the same listener or address. This is particularly useful when several protected domains require separate certificates. HTTP body compression concerns content delivery, IP aggregation is unrelated to TLS certificate selection, and route redistribution is a network-routing function. SNI-based certificate selection therefore provides the mechanism needed when FortiWeb must present different certificates according to the hostname specified by the connecting client.

Question 257. A security administrator wants FortiWeb to inspect traffic for SQL injection and other common web attacks before requests reach the backend application. Which component should be associated with the protected server policy?

1. WAF profile
2. DNS forwarding profile
3. System resource monitor
4. Interface alias

Correct Answer: 1. WAF profile

Explanation :-

A Web Application Firewall profile contains security controls used to inspect and protect web application traffic against attacks such as SQL injection and other application-layer threats. When associated with the appropriate server policy, the WAF profile enables FortiWeb to inspect requests and apply configured detection and enforcement actions. DNS forwarding does not inspect application payloads for SQL injection. System resource monitoring provides operational visibility rather than request-level protection, and an interface alias is simply an administrative or interface configuration element. Therefore, a WAF profile is the appropriate security component when the requirement is to inspect application traffic for common web attacks.

Question 258. Which FortiWeb feature is designed to provide visibility into vulnerabilities in web applications through active security testing?

1. Web vulnerability scanner
2. HA heartbeat
3. Static route
4. Administrative timeout

Correct Answer: 1. Web vulnerability scanner

Explanation :-

A web vulnerability scanner is designed to test web applications for security weaknesses and provide information about vulnerabilities that may require remediation. Vulnerability scanning can complement runtime WAF protection by identifying weaknesses in the application itself rather than relying solely on blocking malicious requests. An HA heartbeat supports communication between high-availability members, while static routes control network forwarding. Administrative timeout controls how long an administrator session can remain inactive. When the objective is to actively assess a web application for vulnerabilities and obtain security findings, the web vulnerability scanner is the relevant FortiWeb capability.

Question 259. An administrator wants FortiWeb to maintain service availability if one appliance fails. Which FortiWeb capability addresses this requirement?

1. URL rewriting
2. High availability
3. Content scraping detection
4. API schema validation

Correct Answer: 2. High availability

Explanation :-

High availability, or HA, allows FortiWeb appliances to work together so that service can continue when a member becomes unavailable, depending on the configured HA architecture and failure conditions. HA mechanisms can synchronize relevant state and coordinate device roles so that protected applications remain accessible during an appliance failure. URL rewriting modifies application URLs, content scraping detection addresses automated content collection, and API schema validation focuses on API request structure. None of those features is designed to provide appliance-level redundancy. Therefore, high availability is the FortiWeb capability directly associated with maintaining service continuity when an appliance failure occurs.

Question 260. A FortiWeb administrator needs to investigate why legitimate application requests are being blocked. Which information source is most useful for identifying the security policy or detection that caused the action?

1. FortiWeb logs
2. DNS cache entries only
3. Interface descriptions
4. Certificate expiration dates only

Correct Answer: 1. FortiWeb logs

Explanation :-

FortiWeb logs provide detailed information about security events and application traffic that can help administrators determine why a request was allowed, blocked, or otherwise handled by a security policy. When troubleshooting false positives, an administrator can review relevant log details such as the detected rule, source information, requested resource, and action taken. DNS cache entries alone do not explain WAF enforcement decisions, interface descriptions provide administrative information, and certificate expiration dates address certificate lifecycle rather than request filtering. Reviewing FortiWeb logs is therefore an important troubleshooting step when legitimate traffic appears to be incorrectly blocked by application-security controls.