View Full Fortinet NSE5_FWB_AD-8.0 Exam Dumps and Practice Test Dumps

 

Question 261. An administrator is configuring FortiWeb to protect an application that uses HTTPS. The administrator wants FortiWeb to inspect the encrypted traffic while maintaining HTTPS between FortiWeb and the backend server. Which configuration is required?

1. HTTP compression only
2. SSL/TLS offloading with re-encryption to the backend
3. Static URL filtering only
4. DNS forwarding with caching

Correct Answer: 2. SSL/TLS offloading with re-encryption to the backend

Explanation :-

When FortiWeb terminates the client-side HTTPS connection, it can decrypt the traffic and inspect the HTTP requests before forwarding them to the backend. If the backend must also receive encrypted traffic, FortiWeb can establish a separate TLS connection toward the backend, effectively re-encrypting the inspected traffic. This architecture allows security inspection while preserving encryption on both network segments. HTTP compression does not provide TLS termination, static URL filtering does not decrypt HTTPS traffic, and DNS forwarding is unrelated to application-layer encryption. The key concept is that client-side and server-side TLS connections can be handled independently, allowing FortiWeb to inspect traffic between them.

Question 262. Which FortiWeb object represents the backend web server that can receive traffic from a protected virtual server?

1. Real server
2. WAF signature
3. Authentication realm
4. Bot detection profile

Correct Answer: 1. Real server

Explanation :-

A real server represents an actual backend application server to which FortiWeb can forward client requests. Real servers can be organized into server pools when multiple backend systems provide the same application service. FortiWeb can use health checks to determine whether a real server is available before forwarding traffic to it. WAF signatures detect application attacks, authentication realms define authentication-related settings, and bot detection profiles identify automated clients. These objects do not represent backend application destinations. Therefore, when configuring the actual web server that should receive requests from FortiWeb, the administrator uses a real-server configuration.

Question 263. An organization publishes several web applications behind one FortiWeb appliance. Each application has its own hostname and backend server. Which configuration most directly allows FortiWeb to distinguish the applications and apply the appropriate policies?

1. A single DNS cache entry
2. Separate virtual servers and server policies
3. One global static route
4. One administrator account

Correct Answer: 2. Separate virtual servers and server policies

Explanation :-

FortiWeb can publish multiple applications by defining the appropriate virtual-server and server-policy configurations. A virtual server represents the listener or published application endpoint, while the associated server policy determines how traffic is processed and forwarded. Hostnames, ports, certificates, backend resources, and security profiles can be associated with the appropriate application configuration. A DNS cache entry does not determine WAF policy selection, and a static route only controls network forwarding. An administrator account controls management access rather than application traffic. Using separate virtual servers and policies provides the required logical separation between independently protected applications.

Question 264. Which FortiWeb capability helps detect automated clients by analyzing browser behavior rather than relying exclusively on an IP address reputation?

1. Bot mitigation
2. Static route filtering
3. SSL certificate import
4. Server health checking

Correct Answer: 1. Bot mitigation

Explanation :-

Bot mitigation is designed to identify and control automated clients accessing web applications. Depending on the configured method, FortiWeb can evaluate behavioral characteristics and other indicators to distinguish legitimate human users from automated traffic. This is particularly important because malicious automation may originate from frequently changing IP addresses, making IP reputation alone insufficient. Static route filtering controls packet forwarding, certificate import manages cryptographic certificates, and server health checking determines backend server availability. Bot mitigation therefore provides application-layer controls specifically intended to detect and manage automated clients, including potentially malicious bots performing scraping, credential attacks, or other abusive activities.

Question 265. An API accepts requests containing JSON objects. The administrator wants FortiWeb to verify that requests conform to the expected API structure before forwarding them. Which capability is most appropriate?

1. API schema validation
2. DNS load balancing
3. SSL certificate renewal
4. Interface monitoring

Correct Answer: 1. API schema validation

Explanation :-

API schema validation allows FortiWeb to compare API requests against an expected schema or defined structure. This is useful for APIs that accept structured formats such as JSON because the security policy can identify requests containing unexpected fields, incorrect data types, or other deviations from the documented API contract. DNS load balancing does not validate API payloads, certificate renewal concerns TLS credentials, and interface monitoring provides operational information rather than application-content validation. By enforcing the expected API schema, FortiWeb can reject malformed or unauthorized request structures before they reach the backend application, reducing the application’s exposure to malformed input and certain abuse techniques.

Question 266. A FortiWeb administrator wants to reduce repeated requests to a backend server for identical static content. Which application-delivery feature can provide this function?

1. IP reputation
2. Web caching
3. API authentication
4. HTTP parameter validation

Correct Answer: 2. Web caching

Explanation :-

Web caching allows FortiWeb to store eligible responses and serve subsequent requests from the cache instead of repeatedly forwarding identical requests to the backend server. This can reduce backend processing requirements and improve response times for suitable static or cacheable content. IP reputation is a security mechanism for evaluating source addresses, API authentication controls access to APIs, and HTTP parameter validation checks request values against configured requirements. Caching must be configured carefully because dynamic or personalized content may not be appropriate for caching. When the objective is to reduce repeated backend requests for identical cacheable content, web caching is the relevant application-delivery feature.

Question 267. A protected web application is receiving a large number of requests from a single client within a short period. The administrator wants FortiWeb to restrict the request rate rather than block the client permanently. Which mechanism is appropriate?

1. Rate limiting
2. Certificate revocation
3. URL rewriting
4. DNS forwarding

Correct Answer: 1. Rate limiting

Explanation :-

Rate limiting controls the number of requests that a client or other defined traffic category can make within a specified time period. It is useful when an administrator wants to reduce excessive request rates without necessarily permanently denying access to the source. Rate limiting can help protect application resources against abusive clients, traffic spikes, and certain application-layer DoS behaviors. Certificate revocation addresses certificate trust, URL rewriting changes request or response URLs, and DNS forwarding handles name-resolution traffic. Therefore, when the requirement is to enforce a request threshold over time while allowing continued access within that threshold, rate limiting is the appropriate control.

Question 268. Which FortiWeb security function is specifically intended to protect web applications against cross-site scripting attacks?

1. WAF protection
2. Static routing
3. Network interface monitoring
4. System backup

Correct Answer: 1. WAF protection

Explanation :-

Web Application Firewall protection can detect and block application-layer attacks such as cross-site scripting, depending on the configured security rules and signatures. Cross-site scripting involves malicious script content being introduced into application inputs or responses and can potentially affect users interacting with the vulnerable application. FortiWeb’s WAF capabilities provide inspection of HTTP and HTTPS application traffic and can apply configured security controls against recognized attack patterns. Static routing and interface monitoring operate at the network and infrastructure levels, while system backup is a configuration-protection function. WAF protection is therefore the relevant FortiWeb security mechanism for defending web applications against cross-site scripting attacks.

Question 269. An administrator observes that a WAF policy is blocking a request that appears legitimate. What should the administrator examine first to determine which security rule triggered the block?

1. The FortiWeb security event log
2. The physical rack location
3. The DNS server’s cache only
4. The administrator’s browser history

Correct Answer: 1. The FortiWeb security event log

Explanation :-

FortiWeb security event logs provide information about detected security events and the actions taken by configured policies. When investigating a suspected false positive, the administrator should examine the relevant event to identify the detection mechanism, rule, policy, source information, requested resource, and enforcement action. This information helps determine whether the request was blocked by a WAF signature, validation rule, access-control policy, or another security mechanism. Physical location, DNS cache information, and an administrator’s browser history do not directly identify the FortiWeb rule responsible for blocking an application request. Reviewing the security event log is therefore a logical first troubleshooting step.

Question 270. Which FortiWeb deployment mode places the appliance between clients and backend servers as an application-layer proxy?

1. Reverse proxy mode
2. Offline monitoring mode
3. Transparent bridge mode only
4. Standalone DNS mode

Correct Answer: 1. Reverse proxy mode

Explanation :-

In reverse proxy mode, FortiWeb accepts client connections on behalf of protected backend applications and then establishes connections toward the appropriate backend servers. This gives FortiWeb an application-layer position where it can inspect HTTP or HTTPS traffic, enforce WAF policies, perform authentication, apply bot controls, and provide application-delivery functions. Transparent bridge mode operates differently by remaining transparent within the traffic path. Offline monitoring does not provide the same inline proxy behavior, and standalone DNS operation is unrelated to FortiWeb’s WAF deployment architecture. Reverse proxy mode is therefore the deployment model most directly associated with FortiWeb acting as an application-layer proxy.

Question 271. An administrator needs to configure FortiWeb to distribute client requests among several backend servers while avoiding servers that fail availability checks. Which combination is required?

1. Server pool and health check
2. DNS cache and URL rewrite
3. WAF signature and certificate authority
4. Administrator profile and audit log

Correct Answer: 1. Server pool and health check

Explanation :-

A server pool defines the backend real servers available to receive application traffic, while health checks determine whether those servers are operational. FortiWeb can use the health-check results when selecting an available backend server, helping prevent new requests from being sent to an unavailable application instance. DNS caching and URL rewriting provide different functions and do not directly establish backend health-aware load balancing. WAF signatures provide application-security detection, while certificate authorities and administrator profiles address other aspects of security and management. Combining a server pool with an appropriate health-check configuration therefore provides the basic foundation for distributing traffic among healthy backend servers.

Question 272. Which FortiWeb feature can help enforce security requirements for cookies used by a web application?

1. HTTP session cookie security
2. Static route redistribution
3. DNS forwarding
4. Server pool monitoring

Correct Answer: 1. HTTP session cookie security

Explanation :-

HTTP session cookie security provides controls for protecting cookies used to maintain application sessions. Proper cookie security can help reduce risks associated with cookie manipulation or exposure by enforcing appropriate security characteristics and inspecting cookie behavior. This is important because session cookies may represent authenticated application sessions and can be valuable targets for attackers. Static route redistribution and DNS forwarding do not inspect or protect HTTP session cookies. Server pool monitoring focuses on backend server availability. Therefore, when the requirement specifically concerns securing cookies used by a web application, the appropriate FortiWeb functionality is HTTP session cookie security.

Question 273. A company wants to identify vulnerabilities in its web application before deploying a new version to production. Which FortiWeb capability is intended for this type of assessment?

1. Web vulnerability scanning
2. Client IP persistence
3. HTTP compression
4. SSL session resumption

Correct Answer: 1. Web vulnerability scanning

Explanation :-

Web vulnerability scanning is designed to assess web applications for security weaknesses and identify potential vulnerabilities. It can be useful before production deployment because development or security teams can use the findings to address weaknesses before the application becomes publicly accessible. Client IP persistence is associated with maintaining traffic affinity to a backend server, while HTTP compression reduces transferred content size. SSL session resumption improves TLS performance by allowing suitable sessions to resume without a complete handshake. These functions do not perform application vulnerability assessments. Web vulnerability scanning therefore directly matches the requirement to test an application for security weaknesses before deployment.

Question 274. Which FortiWeb feature can use learned application behavior to help identify requests that deviate from normal patterns?

1. Machine-learning anomaly detection
2. Static DNS entries
3. Interface aggregation
4. Certificate chain validation

Correct Answer: 1. Machine-learning anomaly detection

Explanation :-

Machine-learning anomaly detection uses learned application behavior to identify traffic that differs from established normal patterns. This approach can help detect previously unseen or unusual requests that may not match traditional fixed signatures. FortiWeb’s machine-learning capabilities can complement conventional WAF protection by providing behavioral analysis of application traffic. Static DNS entries provide name-resolution information, interface aggregation combines network interfaces, and certificate chain validation verifies certificate trust relationships. None of these functions learns application request behavior. Machine-learning anomaly detection is therefore the appropriate feature when the security objective is to identify deviations from an established baseline of normal application activity.

Question 275. An administrator wants to authenticate users before allowing access to a protected web application and use an external directory service for user verification. Which capability should be configured?

1. Authentication with an external identity source
2. Static content caching
3. Server health checking
4. URL compression

Correct Answer: 1. Authentication with an external identity source

Explanation :-

FortiWeb can integrate authentication with external identity sources so that users can be verified against centrally managed credentials or identity services. This approach allows organizations to avoid maintaining separate application credentials on the FortiWeb appliance and can support centralized access management. Static content caching improves application delivery, server health checking monitors backend availability, and URL compression does not authenticate users. The exact external authentication mechanism depends on the organization’s identity infrastructure and FortiWeb configuration. When the requirement is to verify users through an external directory or identity source before granting application access, external identity-source authentication is the relevant capability.

Question 276. Which FortiWeb function is most appropriate for detecting malicious requests that attempt to manipulate database queries through application input fields?

1. SQL injection protection
2. DNS forwarding
3. HA synchronization
4. HTTP caching

Correct Answer: 1. SQL injection protection

Explanation :-

SQL injection protection is designed to identify malicious input intended to alter database queries processed by a vulnerable application. Attackers may attempt to insert SQL syntax into parameters, form fields, headers, or other application inputs to manipulate database operations. FortiWeb can inspect application traffic and use WAF security mechanisms to detect known SQL injection patterns and related attack behavior. DNS forwarding resolves names, HA synchronization supports redundancy, and HTTP caching stores eligible content for improved performance. These functions do not directly analyze application input for database-injection attacks. SQL injection protection is therefore the appropriate security control for this threat.

Question 277. A FortiWeb HA deployment contains two appliances. The administrator wants configuration and operational state to remain synchronized between the members. Which HA mechanism supports this requirement?

1. HA synchronization
2. URL rewriting
3. API schema discovery
4. HTTP compression

Correct Answer: 1. HA synchronization

Explanation :-

HA synchronization allows FortiWeb appliances participating in a high-availability configuration to exchange relevant configuration and state information. Synchronization helps ensure that the HA members can operate consistently and support failover when required. The exact state synchronized depends on the FortiWeb HA implementation and configuration. URL rewriting modifies application URLs, API schema discovery concerns application interfaces, and HTTP compression reduces content size. None of these provides appliance redundancy or state synchronization. When two FortiWeb appliances must maintain consistent configuration and operational information as members of an HA cluster, HA synchronization is the relevant mechanism.

Question 278. Which application-delivery feature can improve performance by maintaining client affinity to the same backend server?

1. Session persistence
2. IP reputation
3. Web vulnerability scanning
4. WAF signature updates

Correct Answer: 1. Session persistence

Explanation :-

Session persistence, also known as session affinity, can keep a client’s requests associated with the same backend server for the duration of an application session when required by the application architecture. This can be important for applications that maintain session information locally on a specific backend server rather than storing all session state in a shared repository. IP reputation evaluates source-address reputation, vulnerability scanning assesses application weaknesses, and WAF signature updates improve attack detection. Session persistence therefore addresses the requirement to maintain client affinity during load-balanced application delivery and can prevent session-related problems when requests move between backend servers.

Question 279. A security team wants FortiWeb to record security events so that administrators can investigate blocked requests and identify attack trends. Which configuration area is most relevant?

1. Logging
2. DNS forwarding
3. Static routing
4. Certificate enrollment

Correct Answer: 1. Logging

Explanation :-

Logging provides the visibility required to record and investigate security events generated by FortiWeb. Security logs can contain information about blocked requests, detected attacks, source addresses, URLs, policies, and other relevant details depending on the configured logging level and event type. This information supports troubleshooting, incident investigation, compliance activities, and security trend analysis. DNS forwarding and static routing provide network functions, while certificate enrollment manages certificate acquisition. Neither provides the required security-event record. Therefore, when an organization needs to retain and review information about blocked requests and application-security events, FortiWeb logging is the relevant configuration area.

Question 280. According to the FortiWeb 8.0 Administrator exam objectives, which task is specifically included under application delivery and additional configuration?

1. Implement denial-of-service prevention, logging, and FortiAI-related capabilities
2. Configure only physical switch stacking
3. Configure only wireless access-point authentication
4. Manage only endpoint antivirus signatures

Correct Answer: 1. Implement denial-of-service prevention, logging, and FortiAI-related capabilities

Explanation :-

The FortiWeb 8.0 Administrator exam objectives include application delivery and additional configuration topics such as application delivery optimization, denial-of-service protection, logging, and FortiAI-related functionality. These areas are part of the documented scope of the FortiWeb 8.0 exam. Physical switch stacking, wireless access-point authentication, and endpoint antivirus signature management belong to other Fortinet products or technology areas and are not the focus of the FortiWeb Administrator exam. Understanding the official topic domains is important when preparing because the exam evaluates deployment, configuration, web and API security, bot mitigation, application delivery, DoS protection, logging, FortiAI, troubleshooting, and vulnerability scanning.