View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 241.

A FortiWeb administrator wants to reduce the risk of unauthorized configuration changes. Which practice is MOST appropriate?

1. Use role-based administrator permissions and individual accounts
2. Share one administrator account across the team
3. Disable audit logging
4. Allow management access from every interface

Correct Answer: 1. Use role-based administrator permissions and individual accounts

Explanation:

Role-based administration helps ensure that each administrator receives only the permissions required for assigned responsibilities. Individual accounts also provide accountability because changes can be traced to a specific person. Shared accounts weaken auditability and make it difficult to determine who performed a sensitive action. Management access should also be restricted to trusted networks and secure protocols. Audit logging should remain enabled so configuration changes can be investigated later. This combination supports least privilege, separation of duties, and stronger operational governance for the FortiWeb management plane.

Question 242.

A security team wants to know exactly who modified a web protection profile. Which information is MOST useful?

1. Backend health-check statistics
2. Administrative audit logs
3. IP reputation data
4. Session persistence information

Correct Answer: 2. Administrative audit logs

Explanation:

Administrative audit logs provide visibility into management actions performed on FortiWeb. They can help identify which administrator changed a policy, when the change occurred, and often which configuration area was affected. This information is valuable for troubleshooting, change management, incident response, and compliance. Individual administrator accounts improve the usefulness of these records because activity can be attributed accurately. Backend health statistics and reputation information describe application traffic or infrastructure state rather than management-plane changes.

Question 243.

Why should FortiWeb management access be limited to trusted source networks whenever possible?

1. To improve server load balancing
2. To increase request-body size
3. To reduce exposure of the administrative interface to untrusted systems
4. To disable TLS inspection

Correct Answer: 3. To reduce exposure of the administrative interface to untrusted systems

Explanation:

The management interface provides access to sensitive configuration, certificates, policies, and operational controls. Restricting administrative connectivity to trusted management networks reduces the number of systems that can attempt authentication or exploit a management-plane vulnerability. This should be combined with strong credentials, role-based permissions, secure protocols, and audit logging. Restricting management access does not replace authentication, but it provides an important additional security boundary. Application delivery settings such as load balancing are unrelated to this management-plane protection.

Question 244.

Before making a major FortiWeb configuration change, what should an administrator do?

1. Disable all logs
2. Delete existing server pools
3. Remove all certificates
4. Create a current configuration backup**

Correct Answer: 4. Create a current configuration backup

Explanation:

A current configuration backup provides a recovery point if the planned change introduces an outage, misconfiguration, or unexpected application behavior. Backups are especially important before major policy changes, network changes, upgrades, certificate modifications, or high-availability adjustments. They should be stored securely because configuration files may contain sensitive information. A backup does not prevent problems, but it can significantly reduce recovery time. Deleting logs, server pools, or certificates would create additional risk and would not improve the safety of the change process.

Question 245.

What is the PRIMARY reason to review FortiWeb firmware release notes before an upgrade?

1. To understand supported upgrade paths, behavior changes, fixes, and known considerations
2. To increase bot detection automatically
3. To replace all backend servers
4. To disable policy logging

Correct Answer: 1. To understand supported upgrade paths, behavior changes, fixes, and known considerations

Explanation:

Release notes and upgrade documentation help administrators understand prerequisites, supported upgrade paths, new features, resolved defects, changed behavior, and known issues. This information is essential for planning a production upgrade safely. Administrators should also create a backup, schedule a maintenance window, and validate application behavior after the upgrade. In high-availability environments, the upgrade sequence may require additional planning. Reviewing release documentation reduces the chance that an unexpected compatibility or configuration issue causes an avoidable outage.

Question 246.

Which approach BEST reduces risk when upgrading a production FortiWeb appliance?

1. Upgrade immediately without a backup
2. Follow a tested change plan with backup, validation steps, and recovery options
3. Disable all application protections permanently
4. Remove health checks before upgrading

Correct Answer: 2. Follow a tested change plan with backup, validation steps, and recovery options

Explanation:

A controlled upgrade plan should include a verified configuration backup, supported upgrade path, maintenance timing, validation of critical applications, and recovery or rollback considerations. Testing the upgrade in a nonproduction environment is desirable when possible. After the upgrade, administrators should verify TLS, server pools, health checks, traffic flow, security profiles, and logs. Treating firmware upgrades as formal changes reduces operational risk. An unplanned upgrade can make troubleshooting more difficult if unexpected behavior appears after the new software is installed.

Question 247.

After a FortiWeb firmware upgrade, one application begins generating false positives. What should the administrator review FIRST?

1. Printer settings
2. Rack location
3. Relevant logs, upgrade notes, and the affected protection configuration
4. Desktop themes

Correct Answer: 3. Relevant logs, upgrade notes, and the affected protection configuration

Explanation:

Post-upgrade false positives may result from changed feature behavior, updated detection logic, migrated settings, or application traffic that interacts differently with the new firmware. Administrators should inspect the events to see exactly which control is triggering, review release documentation for relevant changes, and confirm that the protection profile migrated correctly. Changes should be made only after identifying the cause. Broadly disabling protection could create unnecessary exposure. Evidence-based troubleshooting is particularly important after software upgrades because both configuration and feature behavior may have changed.

Question 248.

What is the main benefit of forwarding FortiWeb security logs to a SIEM?

1. It replaces FortiWeb web protection
2. It increases backend server capacity
3. It disables local logs
4. It enables centralized correlation with security events from other systems**

Correct Answer: 4. It enables centralized correlation with security events from other systems

Explanation:

A SIEM can combine FortiWeb events with information from firewalls, endpoints, identity platforms, servers, and other security technologies. This helps analysts identify broader attack campaigns and understand how an application-layer event relates to activity elsewhere in the environment. Centralized logging can also support retention, alerting, dashboards, and compliance reporting. It does not replace FortiWeb protection or necessarily eliminate local logs. The primary value is improved visibility and correlation across multiple security data sources.

Question 249.

Why is time synchronization important for FortiWeb and connected monitoring systems?

1. Accurate timestamps allow events to be correlated correctly across systems
2. It increases web server memory
3. It disables IP reputation
4. It replaces certificate management

Correct Answer: 1. Accurate timestamps allow events to be correlated correctly across systems

Explanation:

Incident response often requires administrators to reconstruct a sequence of events across FortiWeb, backend servers, firewalls, authentication platforms, and SIEM tools. If system clocks differ substantially, correlation becomes difficult and timelines may be misleading. Accurate time is also relevant to certificate validation and scheduled operations. FortiWeb should therefore use reliable time synchronization according to organizational standards. Time configuration is an operational foundation that improves the reliability of logging, troubleshooting, and security investigations.

Question 250.

A FortiWeb administrator receives too many low-priority alerts and begins overlooking important events. What is the BEST response?

1. Disable all security logs
2. Tune alert thresholds, severity, and notification criteria
3. Disable web protection
4. Remove attack signatures

Correct Answer: 2. Tune alert thresholds, severity, and notification criteria

Explanation:

Excessive notifications can create alert fatigue, making it harder for administrators to identify events that genuinely require action. Alerting should be tuned so high-value events generate immediate attention while lower-value activity remains available in logs for investigation or trend analysis. Administrators can adjust thresholds, severity handling, event categories, and escalation criteria. Completely disabling logging or protection would reduce visibility and security. Effective monitoring balances sufficient detail with actionable notification volume.

Question 251.

A FortiWeb dashboard shows a sharp increase in requests to a login endpoint from automated clients. Which controls should the administrator review?

1. Bot mitigation and rate limiting
2. Server persistence only
3. Health checks only
4. Certificate expiration only

Correct Answer: 1. Bot mitigation and rate limiting

Explanation:

A sudden increase in automated login requests may indicate credential stuffing, brute-force attempts, account enumeration, or another form of authentication abuse. Bot mitigation can help distinguish automated clients from legitimate users, while rate limiting can reduce the frequency of requests reaching the login endpoint. Administrators should review logs before changing thresholds to understand the traffic pattern. These controls should also complement strong authentication, multifactor authentication, account monitoring, and application-side protections.

Question 252.

A FortiWeb server pool member receives significantly more requests than the other healthy members. Which configuration should be reviewed FIRST?

1. Data leak prevention
2. Load-balancing algorithm, member weight, and persistence settings
3. IP reputation
4. Signature exceptions

Correct Answer: 2. Load-balancing algorithm, member weight, and persistence settings

Explanation:

Uneven backend traffic may be intentional or may indicate a configuration issue. Administrators should review the selected load-balancing method, any configured weights, and session persistence behavior. Persistence can cause users to remain attached to one server, while weighting can intentionally direct more traffic to a higher-capacity member. Health status should also be confirmed because failed members shift load toward remaining servers. Security controls such as DLP or IP reputation do not directly determine backend traffic distribution.

Question 253.

FortiWeb marks a backend server unhealthy even though administrators can browse to it manually. What should be checked FIRST?

1. Attack signature severity
2. Bot mitigation settings
3. The health-check URL, protocol, expected response, and server behavior
4. Administrator account permissions

Correct Answer: 3. The health-check URL, protocol, expected response, and server behavior

Explanation:

A server may appear functional to an administrator but still fail the exact health check FortiWeb performs. The configured URL may have changed, the response may now require authentication, the server may return a redirect, or the expected content may no longer match. Administrators should compare the configured test with the actual server response before assuming the backend is failing. Correct health-check design is important because inaccurate checks can unnecessarily remove healthy servers from the load-balancing pool.

Question 254.

A web protection exception was created six months ago for a temporary application issue. What should the administrator do now?

1. Convert it into a broader exception
2. Ignore it permanently
3. Disable logging for the exception
4. Review whether the exception is still required and remove or narrow it if possible**

Correct Answer: 4. Review whether the exception is still required and remove or narrow it if possible

Explanation:

Temporary exceptions can become persistent security gaps if they are never revisited. Administrators should periodically review why each exception exists, whether the application still requires it, and whether a more precise scope is possible. Application updates may have resolved the original false positive. Removing obsolete exceptions restores the full protection of the affected security control. If an exception remains necessary, it should be documented and kept as narrow as practical. Regular exception review is an important part of WAF policy lifecycle management.

Question 255.

Which practice BEST supports long-term attack trend analysis on FortiWeb?

1. Maintain sufficient log retention and centralized reporting
2. Delete attack logs daily
3. Disable event logging after deployment
4. Review only current sessions

Correct Answer: 1. Maintain sufficient log retention and centralized reporting

Explanation:

Historical logs allow administrators to compare attack frequency, targeted URLs, source patterns, signature activity, and severity over longer periods. This can reveal trends that are not visible in short-term monitoring. Centralized reporting and SIEM platforms can help analyze large event sets and correlate them with activity from other security systems. Retention periods should be aligned with organizational and compliance requirements. Deleting logs too quickly reduces the evidence available for investigations and makes trend analysis difficult.

Question 256.

Why should FortiWeb configuration backups be stored securely?

1. Backups improve load balancing only when encrypted
2. They may contain sensitive configuration and security information
3. Secure storage increases session persistence
4. Backups are used as attack signatures

Correct Answer: 2. They may contain sensitive configuration and security information

Explanation:

Configuration backups may contain network details, policy definitions, server information, certificate-related configuration, administrative settings, and other sensitive data. Unauthorized access to a backup could give an attacker valuable information about the protected environment. Backups should therefore be stored in a secure location with appropriate access controls and retention practices. Administrators should also verify periodically that backups are current and usable for recovery. Secure backup handling is part of operational resilience and configuration governance.

Question 257.

A new application release adds several API endpoints. What should the FortiWeb administrator do?

1. Review the new traffic and update relevant protection, access, and behavioral policies
2. Ignore the change because FortiWeb policies never need updates
3. Disable the WAF for the new APIs
4. Remove attack logging

Correct Answer: 1. Review the new traffic and update relevant protection, access, and behavioral policies

Explanation:

New API endpoints can introduce different URLs, methods, parameters, authentication flows, and payload structures. FortiWeb configuration should be reviewed to ensure these endpoints are protected appropriately and are not accidentally blocked by existing controls. URL access policies, method restrictions, signatures, rate controls, and behavioral models may require updates. Coordination with the application team helps administrators understand expected behavior. WAF configuration should evolve with the application lifecycle rather than remaining static while the protected application changes.

Question 258.

After a major API change, FortiWeb machine-learning protection begins flagging valid requests. What is the BEST response?

1. Disable all machine learning permanently
2. Retrain or retune the model using validated new API traffic
3. Block the entire API
4. Disable logging

Correct Answer: 2. Retrain or retune the model using validated new API traffic

Explanation:

Machine-learning models reflect the normal behavior they have previously observed. Major API changes may introduce new paths, methods, JSON structures, parameters, or value patterns that the model considers anomalous. Administrators should validate that the traffic is legitimate and update the model so it reflects current application behavior. Monitoring should continue until false positives are under control before strict blocking is restored. This preserves the benefits of behavioral detection while allowing the security policy to adapt to legitimate application evolution.

Question 259.

A restrictive FortiWeb policy is being prepared for a critical application. What is the BEST deployment strategy?

1. Validate the policy with representative traffic and logs before broad enforcement
2. Enable maximum blocking immediately for every user
3. Disable logging during the rollout
4. Remove health checks until deployment is complete

Correct Answer: 1. Validate the policy with representative traffic and logs before broad enforcement

Explanation:

Representative testing helps identify false positives and unexpected interactions before a restrictive policy affects the entire production user base. Administrators should test common user workflows, APIs, authentication, uploads, administrative functions, and less common legitimate requests. FortiWeb logs can reveal which rules would trigger and provide evidence for tuning. Once the policy behaves as intended, enforcement can be expanded gradually. Immediate global blocking increases outage risk, while disabling logs removes the information needed to troubleshoot deployment problems.

Question 260.

Which statement BEST describes mature FortiWeb operational governance?

1. Use shared administrator accounts for convenience
2. Perform upgrades without backups
3. Keep every exception permanently
4. Combine secure administration, auditable changes, backups, planned upgrades, centralized logging, policy tuning, and continuous application review**

Correct Answer: 4. Combine secure administration, auditable changes, backups, planned upgrades, centralized logging, policy tuning, and continuous application review

Explanation:

Mature FortiWeb operations combine technical protection with disciplined administration. Management access should be restricted and role based, configuration changes should be auditable, and reliable backups should support recovery. Firmware upgrades should follow a tested change process, while centralized logging provides visibility for security monitoring and incident investigation. Exceptions, behavioral models, access rules, and protection profiles should be reviewed as applications evolve. This continuous governance approach helps maintain both security and availability rather than treating the WAF as a static appliance that needs attention only during incidents.