View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 181.

A FortiWeb administrator wants to publish several web applications through one FortiWeb appliance while keeping backend servers hidden from clients. Which deployment model is MOST appropriate?

1. Reverse proxy mode
2. Offline monitoring mode
3. Packet capture mode
4. DNS relay mode

Correct Answer: 1. Reverse proxy mode

Explanation:

Reverse proxy mode allows FortiWeb to act as the client-facing endpoint for protected applications. Clients connect to FortiWeb, which terminates the incoming session, inspects the request, applies security controls, and forwards approved traffic to the appropriate backend server. This architecture keeps backend addresses hidden from clients and supports extensive application-layer features, including TLS termination, re-encryption, server load balancing, health checks, authentication integration, and policy enforcement. It is generally the preferred mode when the organization wants FortiWeb to actively proxy traffic and provide a strong separation between public access and internal application servers.

Question 182.

A FortiWeb health check confirms that a server is reachable but the application returns an unexpected page. What should the administrator improve?

1. IP reputation configuration
2. Configure an HTTP or HTTPS health check that validates expected application content
3. Session persistence
4. Signature severity

Correct Answer: 2. Configure an HTTP or HTTPS health check that validates expected application content

Explanation:

A simple network-level health check may confirm that the server is reachable, but it cannot determine whether the correct application is functioning. An application-aware HTTP or HTTPS check can request a specific page and verify an expected response code, string, or other content. If the response does not match expectations, FortiWeb can mark the server unhealthy and temporarily remove it from load balancing. This gives a more realistic measure of application availability and helps prevent clients from being sent to a server that is technically online but not correctly serving the protected application.

Question 183.

A web application loses user state whenever requests are distributed between backend servers. Which FortiWeb setting should be reviewed?

1. Data leak prevention
2. IP reputation
3. Session persistence
4. Web attack signatures

Correct Answer: 3. Session persistence

Explanation:

Session persistence helps ensure that requests from the same client or application session continue to reach the same backend server. This is important when session information is stored locally on each server and is not shared across the pool. Without persistence, load balancing may direct a user to different servers during one session, causing authentication loss or application errors. The chosen persistence method should align with the way the application identifies sessions. Persistence is an application-delivery function and works alongside health checks and load balancing to maintain a consistent user experience.

Question 184.

FortiWeb decrypts incoming HTTPS traffic and then establishes a new HTTPS session to the backend. What is the MAIN benefit?

1. It eliminates the need for certificates
2. It prevents inspection
3. It disables load balancing
4. It allows inspection while preserving encryption to the backend**

Correct Answer: 4. It allows inspection while preserving encryption to the backend

Explanation:

FortiWeb can terminate the client TLS session to inspect the underlying HTTP request and apply WAF protections. After inspection, it can create a separate encrypted connection to the backend server. This maintains confidentiality on both the external and internal network segments while still allowing FortiWeb to inspect application traffic. This design is useful in environments with strict encryption requirements or where internal networks are not considered fully trusted. Administrators should configure backend certificate trust correctly so the second TLS connection provides authentication as well as encryption.

Question 185.

A protected application expects no more than 50 HTTP headers per request. Which FortiWeb feature can enforce this type of limit?

1. HTTP protocol constraints
2. Session persistence
3. Server load balancing
4. IP reputation

Correct Answer: 1. HTTP protocol constraints

Explanation:

HTTP protocol constraints can enforce structural limits on requests, including header counts, header lengths, request body size, parameter counts, and supported methods. These restrictions help reject malformed or abusive requests before they reach the backend application. If legitimate traffic never contains more than 50 headers, administrators can configure a reasonable threshold near that expectation. The value should be tested carefully to avoid false positives. Protocol constraints complement signatures and behavioral analysis by enforcing what normal HTTP traffic should look like.

Question 186.

An API legitimately uses GET, POST, PUT, and PATCH but never requires TRACE. What is the BEST configuration?

1. Allow every HTTP method
2. Allow required methods and block TRACE
3. Convert TRACE to GET
4. Disable method validation

Correct Answer: 2. Allow required methods and block TRACE

Explanation:

Allowing only the HTTP methods the application actually requires reduces unnecessary attack surface. If TRACE is not part of the legitimate API workflow, blocking it prevents clients from invoking functionality the application does not need. Administrators should confirm all valid methods before enforcement to avoid disrupting legitimate clients or integrations. Method restrictions should work alongside authentication, authorization, web attack signatures, protocol validation, and secure API coding. This is a practical example of applying least functionality to web applications.

Question 187.

Which FortiWeb feature is MOST directly used to identify known command-injection payloads?

1. Session persistence
2. Server health checking
3. Web attack signatures
4. Load balancing

Correct Answer: 3. Web attack signatures

Explanation:

Web attack signatures inspect application traffic for known malicious patterns associated with common attacks such as command injection, SQL injection, cross-site scripting, and file inclusion. When a request matches a configured signature, FortiWeb can log, alert, or block it according to the policy action. Signature protection is especially effective against known attack techniques and should be combined with behavioral analysis, protocol constraints, access controls, and secure application development. Application-delivery functions such as persistence and load balancing do not inspect payloads for malicious content.

Question 188.

A legitimate request is being blocked because one parameter repeatedly triggers a signature. What is the BEST corrective action after validation?

1. Disable the whole WAF
2. Disable all signatures
3. Exclude the entire application
4. Create a narrowly scoped exception for that specific condition**

Correct Answer: 4. Create a narrowly scoped exception for that specific condition

Explanation:

The safest way to handle a confirmed false positive is to create the smallest possible exception. The administrator should identify the specific URL, parameter, signature, and request behavior responsible for the match. Limiting the exception to that exact context preserves the signature’s protection for other parts of the application. Broadly disabling the WAF or signature category would introduce unnecessary risk. Exceptions should be documented and reviewed periodically because application changes may eventually make them unnecessary or change the associated security impact.

Question 189.

What is the PRIMARY benefit of adding behavioral or machine-learning protection to a signature-based FortiWeb policy?

1. It can identify anomalous requests that may not match known attack signatures
2. It removes the need for authentication
3. It eliminates all application vulnerabilities
4. It automatically fixes source code

Correct Answer: 1. It can identify anomalous requests that may not match known attack signatures

Explanation:

Behavioral protection can learn normal application request patterns and detect significant deviations from that baseline. This can help identify new, customized, or unusual attacks that do not correspond exactly to known signatures. It complements signature-based detection by adding anomaly-focused analysis. Behavioral models require representative learning and careful tuning because unusual but legitimate requests may otherwise be classified as suspicious. The technology does not eliminate the need for secure coding, authentication, signatures, or monitoring, but it provides an additional layer of application protection.

Question 190.

Before enabling strict blocking for a newly trained FortiWeb behavioral policy, what should the administrator do?

1. Disable attack logging
2. Review anomalies and verify the model reflects legitimate application behavior
3. Delete server pools
4. Remove certificates

Correct Answer: 2. Review anomalies and verify the model reflects legitimate application behavior

Explanation:

A behavioral model can only make accurate decisions if it has observed a representative range of valid application activity. Administrators should review detected anomalies and ensure common workflows, APIs, administrative actions, scheduled jobs, and less frequent but legitimate requests are represented before moving to blocking. Additional learning or tuning may be needed. A staged transition from learning to monitoring and then enforcement reduces false positives and lowers the risk of application disruption. Logs should remain enabled so administrators can evaluate model accuracy throughout the process.

Question 191.

A public login page is receiving automated brute-force attempts from scripts. Which FortiWeb controls are MOST relevant?

1. Bot mitigation and rate limiting
2. Load balancing only
3. Health checks only
4. Session persistence only

Correct Answer: 1. Bot mitigation and rate limiting

Explanation:

Automated brute-force attacks depend on repeated scripted requests to authentication endpoints. Bot mitigation can help identify automated clients, while rate limiting can restrict excessive request frequency. Administrators should tune these controls carefully because legitimate users may share IP addresses through proxies or NAT. These protections are most effective when paired with multifactor authentication, secure password policies, account monitoring, and application-level authentication controls. Load balancing alone would simply distribute the attack traffic among backend systems.

Question 192.

A sensitive administrative path should be accessible only from a trusted management subnet. Which FortiWeb control is MOST appropriate?

1. Increase header-size limits
2. Apply source-based access control to the URL
3. Disable HTTPS
4. Increase load-balancing weight

Correct Answer: 2. Apply source-based access control to the URL

Explanation:

Source-based URL access control can restrict a sensitive application path so that requests are accepted only from approved networks. This reduces external exposure of administrative interfaces and limits the number of systems that can even attempt authentication. Strong user authentication should still be required because source address alone is not sufficient proof of identity. The control should be designed carefully to account for legitimate VPN or remote-management traffic. This approach directly enforces the requirement and complements other application-layer protections.

Question 193.

An organization has retired an old /v1 API endpoint but cannot remove it from the backend immediately. Which FortiWeb feature can block access to it?

1. Server persistence
2. Health checks
3. URL access rules
4. TLS offloading

Correct Answer: 3. URL access rules

Explanation:

URL access rules can explicitly deny requests to a specific endpoint, making them useful when legacy functionality must be blocked before backend removal is complete. Denying access to /v1 reduces the exposed attack surface and prevents users, outdated clients, or scanners from reaching obsolete functionality. Administrators should monitor logs for continued requests, which may indicate old integrations or reconnaissance. The endpoint should still be removed from the application eventually, because WAF controls should complement rather than replace proper application lifecycle management.

Question 194.

A web application exposes confidential account identifiers in responses. Which FortiWeb feature is MOST relevant?

1. Session persistence
2. Load balancing
3. Health checking
4. Data leak prevention**

Correct Answer: 4. Data leak prevention

Explanation:

Data leak prevention can inspect application responses for patterns associated with sensitive information and apply configured actions when protected data is detected. This can help identify accidental disclosure caused by application errors, verbose responses, or poor data handling. FortiWeb DLP should be tuned carefully to minimize false positives and should work alongside backend authorization, secure coding, and data minimization. The best long-term solution is for the application to avoid returning unnecessary sensitive information in the first place.

Question 195.

A file upload endpoint should accept only ZIP archives smaller than 20 MB. What is the BEST FortiWeb configuration?

1. Restrict uploads to the required type and enforce an appropriate size limit
2. Allow all file extensions and sizes
3. Disable inspection for uploads
4. Increase persistence timeout

Correct Answer: 1. Restrict uploads to the required type and enforce an appropriate size limit

Explanation:

Upload policies should align with the actual business requirement. If only ZIP files under 20 MB are needed, unnecessary file types and oversized content should be rejected. This reduces the attack surface and helps limit resource abuse. Administrators should also consider malware inspection where appropriate and remember that file extension alone may not fully establish file content. The backend application should independently validate and securely store uploaded files. A tightly defined allowlist approach is generally safer than accepting arbitrary file formats.

Question 196.

Why should FortiWeb administrators combine IP reputation with signatures, behavioral analysis, and other controls?

1. IP reputation cannot process HTTPS
2. Source addresses can be shared, dynamic, or insufficient to determine request intent
3. Reputation is available only for internal networks
4. Reputation disables other WAF protections

Correct Answer: 2. Source addresses can be shared, dynamic, or insufficient to determine request intent

Explanation:

IP reputation provides useful context but is not a complete security decision by itself. Legitimate users may share addresses through NAT, proxy, or cloud infrastructure, while attackers can move rapidly between addresses. A source with poor reputation may sometimes carry benign requests, and a previously clean source can become malicious. Combining reputation with attack signatures, behavioral analysis, bot mitigation, authentication, protocol constraints, and request context provides more reliable protection. Layered security reduces reliance on any single indicator and improves resilience against evasion.

Question 197.

FortiWeb begins blocking many legitimate requests immediately after an application release. What should the administrator review FIRST?

1. FortiWeb logs and the application’s changed request patterns
2. Printer settings
3. Rack location
4. Desktop wallpaper

Correct Answer: 1. FortiWeb logs and the application’s changed request patterns

Explanation:

Application releases can introduce new URLs, parameters, methods, request body formats, API schemas, or workflows. Existing WAF protections may classify these new legitimate patterns as malicious or anomalous. FortiWeb logs can identify the exact policy, signature, or behavioral rule that triggered. Administrators should compare those events with documented application changes and then tune the relevant protections. Broadly disabling security would be unnecessary and risky. The goal is to update policy so it recognizes legitimate new behavior while maintaining protection elsewhere.

Question 198.

A new API release changes normal payload structures, causing machine-learning protection to flag valid traffic. What should the administrator do?

1. Disable all behavioral protection permanently
2. Retrain or retune the behavioral model using validated new traffic
3. Block every API request
4. Disable logs

Correct Answer: 2. Retrain or retune the behavioral model using validated new traffic

Explanation:

Behavioral models reflect the traffic patterns they previously learned. When an API changes, legitimate requests may differ significantly from the old baseline. Administrators should verify the new application behavior, allow the model to learn the updated traffic, and review anomalies before re-enabling strict enforcement. This preserves the value of behavioral protection while reducing false positives. Permanently disabling the feature would remove an important security layer simply because the application evolved.

Question 199.

A highly restrictive FortiWeb policy is ready for production. Which deployment approach BEST reduces operational risk?

1. Test with representative traffic, monitor the results, tune the policy, and then expand enforcement
2. Enable maximum blocking globally without testing
3. Disable logs during rollout
4. Bypass FortiWeb until users report problems

Correct Answer: 1. Test with representative traffic, monitor the results, tune the policy, and then expand enforcement

Explanation:

A staged rollout allows administrators to identify false positives and compatibility problems before a restrictive policy affects the entire application population. Representative testing should include typical users, authentication flows, APIs, uploads, administrative functions, and less common legitimate operations. FortiWeb logs provide the evidence needed to refine policy. Once behavior is validated, enforcement can be expanded. Immediate global blocking increases outage risk, while disabled logging removes visibility precisely when administrators need it most.

Question 200.

Which statement BEST describes a mature FortiWeb security operations model?

1. Configure FortiWeb once and never change it
2. Use only signatures and ignore application changes
3. Disable monitoring after deployment
4. Continuously maintain application protections, behavioral models, logs, exceptions, backend health, certificates, and policy tuning**

Correct Answer: 4. Continuously maintain application protections, behavioral models, logs, exceptions, backend health, certificates, and policy tuning

Explanation:

A mature FortiWeb deployment requires ongoing administration because protected applications and threat conditions continually change. Administrators should monitor attack and traffic logs, maintain backend pools and health checks, renew and validate certificates, tune signature and behavioral policies, review exceptions, and adjust access controls as applications evolve. New releases may introduce different URLs, parameters, methods, or APIs, while obsolete functionality should be retired. Continuous lifecycle management keeps FortiWeb aligned with legitimate traffic and helps maintain strong protection without unnecessary disruption.