View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 1.

What is the PRIMARY purpose of FortiWeb in an enterprise environment?

1. Protect web applications and APIs from application-layer attacks
2. Replace all Layer 2 switches
3. Provide endpoint antivirus only
4. Act exclusively as a DNS server

Correct Answer: 1. Protect web applications and APIs from application-layer attacks

Explanation:

FortiWeb is a web application firewall designed to protect web applications and APIs against application-layer threats. It can inspect HTTP and HTTPS traffic, detect malicious requests, enforce application-specific security policies, and protect against threats such as SQL injection, cross-site scripting, malicious bots, and other web attacks. FortiWeb can also provide capabilities such as server load balancing, authentication integration, machine-learning-based detection, API protection, and threat analytics depending on the deployment and configuration. It is not intended to replace network switching infrastructure or function solely as endpoint antivirus or DNS. Its core role is securing web-facing applications at the application layer.

Question 2.

Which FortiWeb operating mode allows FortiWeb to act as a reverse proxy between clients and protected web servers?

1. Offline protection mode
2. Reverse proxy mode
3. Transparent inspection only
4. Packet sniffer mode

Correct Answer: 2. Reverse proxy mode

Explanation:

In reverse proxy mode, FortiWeb terminates client connections and establishes separate connections to protected web servers. This gives FortiWeb extensive control over HTTP and HTTPS sessions and allows it to inspect, modify, and secure traffic before forwarding requests to backend applications. Reverse proxy deployments can also support functions such as SSL offloading, load balancing, authentication, and application delivery features. Other deployment modes may inspect traffic differently and can be useful where network topology requirements prevent proxy deployment. However, reverse proxy mode is typically the most feature-rich because FortiWeb actively proxies the client and server connections.

Question 3.

An administrator wants FortiWeb to protect an HTTPS website and inspect the encrypted HTTP requests. What must FortiWeb be able to do?

1. Disable TCP on the server
2. Convert HTTPS to FTP
3. Decrypt the HTTPS session using the appropriate certificate and key configuration
4. Block all TLS connections

Correct Answer: 3. Decrypt the HTTPS session using the appropriate certificate and key configuration

Explanation:

FortiWeb must be able to decrypt HTTPS traffic before it can inspect HTTP application content inside the TLS session. In a reverse proxy deployment, this normally requires configuring the appropriate server certificate and private key on FortiWeb so that it can terminate the client-side TLS connection. FortiWeb can then inspect the decrypted HTTP request, enforce the applicable web protection policy, and establish a separate connection toward the backend server. Depending on the design, traffic to the backend may remain encrypted or be forwarded using another supported configuration. Simply forwarding encrypted packets without decryption would prevent full application-layer inspection of the protected request content.

Question 4.

Which FortiWeb object identifies the backend web servers that host a protected application?

1. Signature exception
2. IP reputation database
3. HTTP content routing rule only
4. Server pool**

Correct Answer: 4. Server pool

Explanation:

A server pool defines one or more backend web servers that FortiWeb can forward traffic to. Server pools are commonly referenced by virtual server or policy-related configuration depending on the deployment design. They can support multiple backend members and may be used with load-balancing algorithms, health checks, and other availability features. This abstraction allows FortiWeb to distribute traffic among several application servers and avoid sending requests to unhealthy members. Signature exceptions and IP reputation objects serve different security functions and do not define the destination application servers themselves.

Question 5.

What is the purpose of a FortiWeb server health check?

1. Determine whether backend servers are available before sending traffic to them
2. Verify endpoint antivirus signatures
3. Check the FortiWeb administrator password
4. Determine whether users are browsing social media

Correct Answer: 1. Determine whether backend servers are available before sending traffic to them

Explanation:

Server health checks allow FortiWeb to determine whether backend application servers are functioning and capable of receiving traffic. A health check can periodically test a server using an appropriate protocol or request and evaluate the response. If a server is considered unavailable, FortiWeb can stop forwarding new requests to that member until it recovers. This improves application availability when multiple backend servers are configured in a pool. Health checks are therefore an application-delivery and resilience function rather than an endpoint security or administrator authentication feature. Proper health-check configuration should reflect the actual application so that FortiWeb can distinguish a functioning server from one that is technically reachable but unable to serve the required application.

Question 6.

Which FortiWeb feature is used to detect known attack patterns such as SQL injection and cross-site scripting?

1. Static routing
2. Web attack signatures
3. ARP inspection
4. DHCP relay

Correct Answer: 2. Web attack signatures

Explanation:

Web attack signatures are used to identify known malicious patterns in HTTP requests and other web application traffic. Signature-based protection can detect attacks such as SQL injection, cross-site scripting, remote file inclusion, command injection, and many other known application-layer techniques. Administrators can configure signature policies, severity handling, exceptions, and enforcement actions according to application requirements. Signature protection works best as part of a layered web security strategy that may also include machine learning, protocol validation, bot mitigation, rate limiting, authentication, and application-specific rules. Routing and DHCP features do not provide comparable inspection of application-layer attack patterns.

Question 7.

An administrator sees legitimate application requests being blocked by a web attack signature. What should the administrator consider doing?

1. Disable all FortiWeb protection permanently
2. Give users administrative access
3. Create a narrowly scoped signature exception after confirming the request is legitimate
4. Remove the protected server from the network

Correct Answer: 3. Create a narrowly scoped signature exception after confirming the request is legitimate

Explanation:

False positives can occur when legitimate application content resembles a known attack pattern. Administrators should first review the event details and confirm that the request is genuinely safe. If so, a carefully scoped exception can be created for the affected signature, URL, parameter, or other relevant condition. The exception should be as narrow as practical so protection remains active for the rest of the application. Disabling an entire signature category or all FortiWeb protection could expose the application unnecessarily. Event analysis and controlled exceptions provide a safer way to resolve compatibility issues while maintaining the overall security posture.

Question 8.

Which FortiWeb function can distribute incoming requests among multiple backend web servers?

1. DNS filtering
2. Endpoint quarantine
3. Email antispam
4. Server load balancing**

Correct Answer: 4. Server load balancing

Explanation:

FortiWeb can distribute incoming web requests across multiple backend servers through server load-balancing functions. This improves scalability and availability by preventing one server from receiving all traffic and by allowing FortiWeb to stop sending requests to unhealthy members. Different load-balancing methods can be selected depending on the application and deployment requirements. Health checks are typically used alongside load balancing so FortiWeb can identify unavailable backend servers. This capability is particularly valuable in reverse proxy deployments where FortiWeb already acts as the intermediary between clients and application servers.

Question 9.

What is the role of a FortiWeb web protection profile?

1. Group application security settings that can be applied to protected web traffic
2. Configure switch spanning tree
3. Assign Windows domain administrator accounts
4. Define physical server rack locations

Correct Answer: 1. Group application security settings that can be applied to protected web traffic

Explanation:

A web protection profile groups multiple FortiWeb security controls into a reusable configuration that can be applied to protected traffic. Depending on the FortiWeb version and configuration, the profile can reference features such as signatures, protocol constraints, URL protection, bot mitigation, machine learning, data leak prevention, file security, and other web application defenses. Profiles simplify policy administration because administrators can build a coherent protection set and associate it with the relevant server or policy configuration. They do not configure network switching or operating-system accounts. Effective profile design should be tuned to the behavior and risk of the protected application.

Question 10.

Why is learning or monitoring legitimate application behavior useful before enabling aggressive FortiWeb blocking?

1. It guarantees that all attacks will disappear
2. It helps reduce false positives by establishing expected application behavior
3. It disables logging
4. It removes the need for security policies

Correct Answer: 2. It helps reduce false positives by establishing expected application behavior

Explanation:

Observing normal application behavior before enabling strict enforcement helps administrators understand which URLs, parameters, methods, request patterns, and user behaviors are legitimate. This is especially important for behavioral or machine-learning-based protections that distinguish expected activity from anomalies. A learning period can reveal application-specific patterns and reduce the chance that legitimate users are blocked after enforcement begins. Learning does not eliminate the need for signatures or other security controls, and it does not guarantee detection of every attack. It is part of a staged deployment strategy that combines observation, tuning, validation, and controlled enforcement.

Question 11.

Which attack attempts to insert malicious database commands into application input?

1. SQL injection
2. ARP spoofing
3. VLAN hopping
4. DHCP starvation

Correct Answer: 1. SQL injection

Explanation:

SQL injection occurs when attacker-controlled input is interpreted as part of a database query. A vulnerable application may allow an attacker to alter query logic, retrieve unauthorized information, modify records, bypass authentication, or perform other database actions. FortiWeb can help detect and block SQL injection using web attack signatures, behavioral techniques, protocol validation, and application-specific policies. Secure application development should still use parameterized queries and proper input handling because a WAF is an additional protection layer rather than a substitute for secure coding. ARP spoofing, VLAN hopping, and DHCP starvation occur at lower network layers.

Question 12.

Which attack injects malicious browser-executable script content into a web application response or stored application content?

1. DNS amplification
2. IP fragmentation
3. Cross-site scripting
4. MAC flooding

Correct Answer: 3. Cross-site scripting

Explanation:

Cross-site scripting, or XSS, involves injecting malicious script content into a web application so that the code is executed in another user’s browser. Depending on the application, XSS may be reflected, stored, or DOM-related. Attackers can use XSS to steal session information, manipulate application content, redirect users, or perform unauthorized actions in the victim’s browser context. FortiWeb can identify many XSS patterns through its application-layer inspection capabilities. Application developers should also implement proper output encoding, input handling, content security controls, and secure framework practices to reduce XSS risk at the source.

Question 13.

An administrator wants FortiWeb to reject HTTP methods that the application never uses. Which security concept does this support?

1. Reducing the application’s exposed attack surface
2. Increasing Layer 2 broadcast traffic
3. Disabling TLS
4. Creating more backend servers

Correct Answer: 1. Reducing the application’s exposed attack surface

Explanation:

Allowing only HTTP methods that the application legitimately requires reduces unnecessary functionality exposed to clients. For example, if an application uses GET and POST but never requires methods such as PUT or DELETE, rejecting the unused methods can reduce opportunities for abuse. FortiWeb can enforce protocol-related restrictions as part of its application security configuration. This follows a least-functionality principle: expose only what the application needs. The control does not replace secure coding or authorization, but it adds another layer of defense against unexpected or malicious request behavior.

Question 14.

Why might an administrator configure HTTP request size limits on FortiWeb?

1. To improve printer performance
2. To prevent excessively large or abnormal requests from reaching the application
3. To configure DNS zones
4. To create Windows users

Correct Answer: 2. To prevent excessively large or abnormal requests from reaching the application

Explanation:

Request size limits can help protect web applications from abnormal or malicious traffic that attempts to consume resources, exploit parser weaknesses, or send data far beyond what the application expects. Administrators should configure limits that reflect legitimate application behavior, including expected upload sizes and request body requirements. Limits that are too restrictive can block legitimate users, while excessively permissive values reduce the benefit. Request constraints are one part of a broader protocol-validation strategy that can also control HTTP methods, header lengths, parameter characteristics, and other request properties.

Question 15.

A protected application allows file uploads. What should the FortiWeb administrator consider when configuring protection?

1. Allowed file types, size limits, upload behavior, and malware-related controls
2. Only the user’s desktop wallpaper
3. The physical rack color of the server
4. Disabling all HTTP inspection

Correct Answer: 1. Allowed file types, size limits, upload behavior, and malware-related controls

Explanation:

File-upload functionality introduces additional application risk because attackers may attempt to upload malware, executable content, oversized files, or file types that the application does not require. Administrators should understand legitimate upload behavior and restrict file types and sizes where appropriate. FortiWeb security features can be configured to inspect or control uploads depending on the environment and available integrations. The backend application should also store uploaded content securely and avoid executing user-provided files directly. Effective protection requires coordination between FortiWeb policy and secure application design.

Question 16.

Which FortiWeb capability can help distinguish automated clients from legitimate human users?

1. Static routing
2. VLAN trunking
3. Server RAID
4. Bot mitigation**

Correct Answer: 4. Bot mitigation

Explanation:

Bot mitigation capabilities help identify and control automated traffic targeting web applications. Automated clients may perform credential stuffing, scraping, inventory abuse, vulnerability scanning, account enumeration, or other unwanted activity. FortiWeb can use multiple detection and enforcement techniques to distinguish suspicious automation from normal user behavior, depending on the configured feature set. Administrators should tune bot controls carefully because legitimate services, search crawlers, monitoring systems, and APIs can also generate automated traffic. Bot management works best alongside rate controls, authentication security, signatures, behavioral detection, and application-specific policies.

Question 17.

An administrator wants to protect a login page against excessive repeated authentication attempts from the same source. Which control is MOST relevant?

1. Rate limiting or login-related access control
2. Changing the backend server hostname
3. Disabling HTTPS
4. Removing all web attack signatures

Correct Answer: 1. Rate limiting or login-related access control

Explanation:

Excessive repeated requests to a login page can indicate brute-force attempts, credential stuffing, automated account testing, or abusive bots. Rate-limiting and login-related controls can reduce the number or frequency of attempts allowed from a source or within a defined context. Administrators should tune thresholds according to expected user behavior so legitimate users are not blocked unnecessarily. These controls should be combined with strong application authentication, multifactor authentication where available, secure password policies, and bot detection. Disabling HTTPS or removing signatures would weaken security rather than mitigate authentication abuse.

Question 18.

What is the purpose of FortiWeb IP reputation features?

1. Assign private addresses to backend servers
2. Identify and act on traffic from sources associated with malicious or suspicious activity
3. Replace all application authentication
4. Configure Layer 2 VLAN tagging

Correct Answer: 2. Identify and act on traffic from sources associated with malicious or suspicious activity

Explanation:

IP reputation uses information about known or suspected malicious sources to help FortiWeb classify inbound traffic. Administrators can use reputation information as another signal when allowing, monitoring, challenging, or blocking requests. This can help reduce traffic from sources associated with scanning, attacks, bot activity, or other suspicious behavior. Reputation should not normally be the only protection mechanism because source addresses can change and legitimate systems may sometimes use shared infrastructure. It is most effective as part of layered application security alongside signatures, behavioral controls, access rules, bot mitigation, and protocol validation.

Question 19.

A FortiWeb administrator wants to investigate why a request was blocked. Which information should be reviewed FIRST?

1. The FortiWeb event or attack log associated with the request
2. The user’s desktop wallpaper
3. Printer configuration
4. Physical server rack label

Correct Answer: 1. The FortiWeb event or attack log associated with the request

Explanation:

FortiWeb logs provide direct evidence about the request, the security rule or signature that matched, the action taken, and other contextual information. Administrators can use this data to determine whether the request was malicious, a false positive, or affected by an incorrectly tuned policy. Logs are also important for identifying repeated attacks, affected URLs, source addresses, and policy behavior. Troubleshooting should begin with the event generated by the actual enforcement decision rather than unrelated endpoint or infrastructure settings. Good logging and retention practices are essential for both routine FortiWeb tuning and security investigations.

Question 20.

Which statement BEST describes a strong FortiWeb deployment strategy?

1. Enable every blocking feature at maximum sensitivity immediately
2. Use FortiWeb only for load balancing and disable security inspection
3. Rely on a single signature to protect the entire application
4. Combine secure deployment mode, tuned protection profiles, signatures, behavioral controls, bot protection, logging, testing, and ongoing policy review**

Correct Answer: 4. Combine secure deployment mode, tuned protection profiles, signatures, behavioral controls, bot protection, logging, testing, and ongoing policy review

Explanation:

A strong FortiWeb deployment uses multiple complementary controls rather than depending on a single feature. Administrators should select an appropriate deployment mode, define protected servers, configure TLS inspection where required, and apply web protection profiles tuned to legitimate application behavior. Signatures can detect known attacks, while behavioral or machine-learning controls can identify abnormal activity. Bot mitigation, rate controls, protocol validation, authentication integration, and reputation features add further layers of defense. Logging is essential for tuning and investigation, and staged testing helps reduce false positives before strict enforcement. Ongoing review is necessary because applications, traffic patterns, software versions, and threats change over time.