View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 201.

A FortiWeb administrator wants to reduce the risk that a single appliance failure makes protected applications unavailable. Which design is MOST appropriate?

1. Deploy FortiWeb high availability
2. Disable backend health checks
3. Use one server pool member only
4. Remove traffic logging

Correct Answer: 1. Deploy FortiWeb high availability

Explanation:

A high-availability deployment reduces reliance on a single FortiWeb appliance by providing another unit that can continue protecting applications if the active device fails, depending on the configured HA design. High availability is especially important for internet-facing or business-critical applications because FortiWeb sits directly in the application traffic path in many deployments. HA should be combined with redundant networking and resilient backend infrastructure. Server health checks solve a different problem by monitoring application servers, while disabling logging or reducing the number of backend servers would not protect against failure of the FortiWeb appliance itself.

Question 202.

A FortiWeb administrator is configuring HTTPS for a new protected site. Which item is required for FortiWeb to terminate the client TLS connection?

1. A DHCP reservation
2. The appropriate server certificate and associated private key
3. A static ARP entry
4. A signature exception

Correct Answer: 2. The appropriate server certificate and associated private key

Explanation:

To terminate HTTPS connections in a reverse proxy deployment, FortiWeb needs the certificate presented to clients and the corresponding private key. This allows FortiWeb to participate in the TLS handshake, decrypt the traffic, inspect the HTTP content, and then forward or re-encrypt the request toward the backend. The certificate should match the application hostname and be trusted by the clients that access the site. Administrators should also monitor certificate expiration and protect private keys carefully. Network addressing objects and signature exceptions do not provide the cryptographic material required for TLS termination.

Question 203.

A certificate used by a protected application is approaching its expiration date. What should the administrator do?

1. Ignore it until users report failures
2. Disable HTTPS permanently
3. Renew and replace the certificate before it expires
4. Remove the protected application

Correct Answer: 3. Renew and replace the certificate before it expires

Explanation:

Expired certificates can cause browser warnings, failed TLS handshakes, API connection failures, and application outages. Administrators should therefore monitor certificate validity periods and renew certificates before expiration. The replacement certificate should contain the correct hostnames, be associated with the correct private key, and maintain the required trust chain. Certificate lifecycle management is an operationally important part of FortiWeb administration because HTTPS is commonly used on both client-facing and backend connections. Waiting for expiration creates avoidable service disruption and can undermine user trust.

Question 204.

A FortiWeb administrator wants different applications to use different backend server pools. Which configuration concept is MOST important?

1. One global server pool for all applications
2. Disable virtual servers
3. Use only IP reputation
4. Map each protected service or policy to the appropriate backend pool**

Correct Answer: 4. Map each protected service or policy to the appropriate backend pool

Explanation:

FortiWeb should direct each protected application to the backend servers that actually host that application. By associating the relevant protected service or policy with the correct server pool, administrators can keep application delivery organized and prevent requests from being forwarded to unrelated servers. Each pool can have its own members, health checks, and load-balancing behavior. A single global pool may be inappropriate when applications have different infrastructure or availability requirements. Correct mapping between the client-facing application and its backend resources is fundamental to reliable reverse proxy operation.

Question 205.

A backend application is responding slowly because one server receives significantly more traffic than the others. Which FortiWeb area should be reviewed FIRST?

1. Server pool load-balancing configuration
2. Data leak prevention
3. Signature exceptions
4. IP reputation categories

Correct Answer: 1. Server pool load-balancing configuration

Explanation:

When traffic distribution is uneven among healthy backend servers, the administrator should review the load-balancing algorithm and any configured member weights or persistence behavior. Some applications intentionally require unequal distribution, while others expect traffic to be spread more evenly. Session persistence may also cause one server to retain more connections than another. Health status should be verified as well because unavailable members can shift load to the remaining servers. DLP, signature exceptions, and IP reputation affect security policy rather than how FortiWeb distributes requests across backend pool members.

Question 206.

A security team wants FortiWeb to detect known malicious web requests but only log them initially rather than block them. Why might this be useful?

1. It removes all attack detection
2. It allows policy behavior to be evaluated before enforcing blocking
3. It prevents logging
4. It disables backend health checks

Correct Answer: 2. It allows policy behavior to be evaluated before enforcing blocking

Explanation:

Using a monitoring or alerting action during initial deployment allows administrators to see which requests would trigger protection without immediately disrupting legitimate traffic. Logs can then be reviewed to distinguish real attacks from false positives and to tune signatures or exceptions before blocking is enabled. This staged approach is especially valuable for complex applications whose legitimate parameters may resemble attack patterns. Once the policy is validated, enforcement can be increased. Monitoring should not be left indefinitely when the organization intends to actively prevent attacks, but it is useful during testing and tuning.

Question 207.

A FortiWeb log shows repeated SQL injection attempts against the same URL from many source addresses. Which conclusion is MOST appropriate?

1. The backend health check is failing
2. The TLS certificate is expired
3. The application is being targeted by a distributed application-layer attack pattern
4. Session persistence is misconfigured

Correct Answer: 3. The application is being targeted by a distributed application-layer attack pattern

Explanation:

Repeated SQL injection attempts against one endpoint from many source addresses indicate active targeting of the application rather than a simple backend delivery issue. The administrator should confirm that the relevant web attack signatures are blocking the malicious requests and review whether additional controls such as rate limiting, reputation, bot mitigation, or source restrictions are appropriate. The application development team should also confirm that the vulnerable-looking parameter is securely handled. Health checks, certificate status, and session persistence do not explain repeated injection payloads appearing in request logs.

Question 208.

A FortiWeb administrator creates a broad signature exception for an entire application to resolve one false positive. What is the MAIN risk?

1. Backend servers will become unavailable
2. TLS will stop functioning
3. Load balancing will be disabled
4. Legitimate attacks may bypass protection across more of the application than necessary**

Correct Answer: 4. Legitimate attacks may bypass protection across more of the application than necessary

Explanation:

Signature exceptions reduce the scope of protection, so they should be as narrow as possible. Creating an application-wide exception for one false positive can allow malicious traffic that would otherwise be detected by the signature. A better approach is to identify the specific URL, parameter, request format, or condition responsible for the false positive and exempt only that case. Exceptions should be documented and periodically reviewed. Broad exclusions may provide a quick operational fix, but they can create significant security gaps that persist unnoticed.

Question 209.

Which FortiWeb feature is MOST appropriate for identifying previously unseen requests that differ substantially from learned application behavior?

1. Behavioral or machine-learning protection
2. Static routing
3. Session persistence
4. Backend health checks

Correct Answer: 1. Behavioral or machine-learning protection

Explanation:

Behavioral and machine-learning protection can establish a model of normal application requests and identify activity that falls outside expected patterns. This can help detect unusual or previously unseen attacks that do not match a known signature. The model should be trained on representative legitimate traffic and carefully tuned before strict blocking is enabled. Behavioral protection is most effective as one layer of a broader security strategy that also includes signatures, protocol validation, bot mitigation, access controls, and secure application development.

Question 210.

An administrator sees many false positives from a behavioral model immediately after a major application redesign. What should be done?

1. Remove all security controls
2. Retrain or retune the model using validated traffic from the redesigned application
3. Block every request permanently
4. Disable all logging

Correct Answer: 2. Retrain or retune the model using validated traffic from the redesigned application

Explanation:

A major redesign can change URLs, parameters, methods, API payloads, and user workflows. A behavioral model trained on the previous version may therefore interpret legitimate new traffic as abnormal. Administrators should validate the new traffic and update the model so it reflects the redesigned application. Monitoring should remain active while the model learns and is reviewed. Permanently disabling behavioral protection would remove a useful security layer, while blocking all requests would make the application unusable. WAF models must evolve alongside the applications they protect.

Question 211.

A public API is receiving excessive automated requests that are consuming backend resources. Which FortiWeb controls should be considered FIRST?

1. Bot mitigation and rate limiting
2. Session persistence only
3. Certificate renewal only
4. Server health checks only

Correct Answer: 1. Bot mitigation and rate limiting

Explanation:

Excessive automated API requests can consume application resources even when the individual requests are otherwise valid. Bot mitigation can help distinguish automated clients from expected users or services, while rate limiting can cap how frequently requests are accepted. The limits should reflect legitimate API use and may need different thresholds for trusted integrations. Authentication, API authorization, and backend capacity controls should also be considered. Load balancing can distribute the traffic but does not by itself prevent abusive request rates.

Question 212.

A management interface should never be reachable from the public internet. Which FortiWeb design BEST supports this requirement?

1. Increase request limits
2. Restrict access to the management URL using approved source networks
3. Disable all signatures
4. Enable more server pool members

Correct Answer: 2. Restrict access to the management URL using approved source networks

Explanation:

Sensitive management paths should be exposed only to the networks that genuinely require access. FortiWeb can apply source-based URL access controls so that requests from public or untrusted networks are rejected before reaching the backend application. Strong authentication should still be used for permitted clients because network location alone does not prove identity. This design reduces attack surface and limits opportunities for brute-force attacks or exploitation of administrative functions. Increasing request limits or backend capacity does not address unwanted exposure.

Question 213.

A FortiWeb administrator wants to block access to several obsolete API endpoints while allowing the rest of the application to remain available. Which feature is MOST appropriate?

1. Load balancing
2. Session persistence
3. URL access rules
4. TLS offloading

Correct Answer: 3. URL access rules

Explanation:

URL access rules allow administrators to control specific application paths independently. Obsolete API endpoints can be denied while the rest of the application remains accessible. This is useful during migrations when legacy functionality cannot be removed from the backend immediately. Logs should be monitored for continued requests because they may indicate outdated clients, integrations, or reconnaissance attempts. The long-term goal should still be to remove deprecated functionality from the application itself, but URL access rules provide immediate enforcement at the WAF layer.

Question 214.

An application is accidentally returning sensitive customer information in error pages. Which FortiWeb capability can help detect this condition?

1. Session persistence
2. Load balancing
3. Health checking
4. Data leak prevention**

Correct Answer: 4. Data leak prevention

Explanation:

Data leak prevention can inspect HTTP responses for sensitive information patterns and apply a configured action when protected data is detected. This can help identify accidental disclosures caused by verbose errors, poorly designed APIs, or excessive application responses. DLP should be tuned carefully to reduce false positives and should complement secure application development, access control, and proper error handling. The preferred long-term fix is to correct the application so it does not return sensitive data unnecessarily, but FortiWeb can provide an additional protective layer while that work is completed.

Question 215.

A business application accepts only CSV file uploads. Which FortiWeb approach BEST reduces upload-related risk?

1. Permit only the required file type and enforce appropriate size limits
2. Allow every file type
3. Disable upload inspection
4. Increase load-balancing weight

Correct Answer: 1. Permit only the required file type and enforce appropriate size limits

Explanation:

File upload policy should match the application’s legitimate business requirements. If users need only CSV files, other formats should be rejected to reduce the attack surface. Administrators should also configure realistic size limits and use available malware or content inspection where appropriate. The backend application should independently validate the uploaded content rather than trusting only the file extension. Restricting uploads using an allowlist-oriented model provides stronger security than accepting arbitrary file types and attempting to block only known dangerous formats.

Question 216.

Why should a FortiWeb administrator review logs after creating a new security exception?

1. To increase backend server capacity
2. To confirm that the exception solves the false positive without allowing unexpected malicious traffic
3. To disable health monitoring
4. To renew certificates automatically

Correct Answer: 2. To confirm that the exception solves the false positive without allowing unexpected malicious traffic

Explanation:

An exception changes the protection boundary and can unintentionally allow more traffic than intended. Reviewing logs after deployment helps confirm that legitimate requests now succeed while suspicious requests continue to be detected or blocked elsewhere. Administrators should check whether the exception is being used only in the expected context and whether attackers appear to be targeting the exempted condition. Exceptions should remain narrowly scoped and should be periodically recertified. Logging provides the operational evidence needed to determine whether the exception is functioning safely.

Question 217.

A FortiWeb administrator sees many requests from sources with poor IP reputation, but some appear legitimate. What is the BEST strategy?

1. Combine reputation with request behavior, signatures, bot controls, and other context
2. Block all internet traffic
3. Disable reputation permanently
4. Trust all sources equally

Correct Answer: 1. Combine reputation with request behavior, signatures, bot controls, and other context

Explanation:

IP reputation is useful but should not be treated as an absolute indicator. Shared hosting, proxies, NAT gateways, and cloud infrastructure can cause legitimate and malicious traffic to originate from the same address ranges. FortiWeb should use reputation as one input alongside signatures, behavioral protection, bot analysis, rate controls, authentication, and other request characteristics. Combining signals improves detection accuracy and reduces the risk of blocking legitimate users solely because of their source address.

Question 218.

A new application release introduces additional API paths and request methods. What should the FortiWeb administrator do?

1. Ignore the changes because WAF policy never needs updates
2. Review and adjust relevant URL, method, signature, and behavioral policies
3. Disable all web protection
4. Remove the backend servers

Correct Answer: 2. Review and adjust relevant URL, method, signature, and behavioral policies

Explanation:

Application releases can change the traffic FortiWeb must recognize as legitimate. New API paths, HTTP methods, parameters, and payload structures may require updates to access rules, protocol constraints, signature exceptions, or behavioral models. Administrators should coordinate with application teams and review logs during the rollout so policy remains aligned with the current application. Failure to update WAF policy can create false positives or leave new functionality insufficiently protected. Security configuration should evolve alongside the application lifecycle.

Question 219.

Before enabling a strict web protection profile for all users, which approach BEST reduces the risk of an application outage?

1. Test with representative traffic, monitor results, tune the profile, then expand enforcement
2. Enable maximum blocking immediately
3. Disable all logging during rollout
4. Remove health checks

Correct Answer: 1. Test with representative traffic, monitor results, tune the profile, then expand enforcement

Explanation:

Representative testing allows administrators to observe how the policy handles normal workflows before the entire user population is affected. Traffic should include common pages, APIs, authentication, uploads, administrative functions, and unusual but legitimate requests. Logs can reveal false positives or overly restrictive limits that need adjustment. Once the profile behaves correctly, enforcement can be expanded gradually. Immediate maximum blocking increases operational risk, while disabled logging prevents administrators from understanding why requests fail.

Question 220.

Which statement BEST describes an effective long-term FortiWeb administration strategy?

1. Configure the appliance once and never review it
2. Use signatures only
3. Focus only on load balancing
4. Maintain certificates, backend health, security policies, logs, exceptions, behavioral models, and application changes continuously**

Correct Answer: 4. Maintain certificates, backend health, security policies, logs, exceptions, behavioral models, and application changes continuously

Explanation:

FortiWeb administration is an ongoing operational and security process. Certificates expire, backend servers change, applications introduce new APIs and request patterns, and attackers adopt new techniques. Administrators should therefore monitor server health, review logs, maintain security signatures and behavioral policies, reassess exceptions, renew certificates, and adjust protection profiles as applications evolve. Continuous review helps preserve both security and availability. Treating the initial configuration as permanent can lead to expired certificates, stale exceptions, false positives, or protection gaps as the environment changes.