View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 301.

A FortiWeb administrator wants to protect the administrative interface from brute-force login attempts. Which approach is MOST appropriate?

1. Restrict management access to trusted networks and enforce strong administrator authentication
2. Disable audit logging
3. Allow management access from every interface
4. Use one shared administrator account

Correct Answer: 1. Restrict management access to trusted networks and enforce strong administrator authentication

Explanation:

The FortiWeb management interface should be exposed only to administrators who genuinely require access. Restricting management connectivity to trusted networks reduces the number of systems capable of attempting authentication. Strong administrator passwords, individual accounts, role-based permissions, and additional authentication protections where available further reduce risk. Audit logging should remain enabled so failed and successful management activity can be investigated. Shared accounts and unrestricted management exposure weaken accountability and unnecessarily increase the attack surface of the appliance itself.

Question 302.

A company wants junior administrators to view FortiWeb logs but not modify security policies. Which feature BEST supports this requirement?

1. Session persistence
2. Role-based administrative permissions
3. IP reputation filtering
4. Server load balancing

Correct Answer: 2. Role-based administrative permissions

Explanation:

Role-based administration allows organizations to assign privileges based on job responsibilities. A junior operator can be given access to dashboards, logs, and monitoring while being prevented from changing web protection profiles, certificates, server pools, or other sensitive settings. This supports least privilege and separation of duties. Individual accounts should also be used so management actions are attributable to specific administrators. Application traffic features such as persistence or load balancing do not control administrative privileges.

Question 303.

An administrator needs to confirm whether an unexpected configuration change occurred overnight. Which data should be checked FIRST?

1. Backend server health statistics
2. Application upload logs
3. FortiWeb administrative audit records
4. Load-balancing weights

Correct Answer: 3. FortiWeb administrative audit records

Explanation:

Administrative audit records provide evidence of management activity and can help determine whether policies, network settings, certificates, or other configuration elements were changed. The records can also indicate which administrator performed the action and when it occurred. This information is particularly useful when application behavior changes unexpectedly and a configuration modification is suspected. Traffic and backend statistics may show the impact of the change, but audit records are the most direct source for identifying management-plane actions.

Question 304.

A major FortiWeb policy change is scheduled for production. Which preparation BEST supports rapid recovery?

1. Disable all logging
2. Delete current configuration files
3. Remove backend health checks
4. Create a verified configuration backup before the change**

Correct Answer: 4. Create a verified configuration backup before the change

Explanation:

A verified configuration backup provides a known recovery point if the planned change causes an outage or unexpected security behavior. The backup should be current, stored securely, and accessible to authorized administrators. Administrators should also document the change and define validation and rollback steps. Backups are especially important before major policy, certificate, networking, high-availability, or firmware changes. Removing logs or health checks would reduce visibility and resilience rather than improve recoverability.

Question 305.

Why should FortiWeb configuration backups be protected with strict access controls?

1. They can contain sensitive network, policy, certificate, and backend information
2. They improve load balancing only when restricted
3. They replace web attack signatures
4. They are used for session persistence

Correct Answer: 1. They can contain sensitive network, policy, certificate, and backend information

Explanation:

Configuration backups can reveal valuable details about protected applications, server pools, network addressing, policies, management settings, and certificate-related configuration. If an attacker obtains a backup, that information could assist reconnaissance or future attacks. Backups should therefore be stored securely and made available only to authorized personnel. Organizations should also maintain appropriate retention and recovery procedures. Configuration backups are primarily an operational resilience mechanism and should be treated as sensitive administrative data.

Question 306.

An administrator is preparing a FortiWeb firmware upgrade. What should be confirmed before the upgrade begins?

1. All attack logs have been deleted
2. The supported upgrade path, release notes, backup, and maintenance plan
3. All server pools have been removed
4. Management authentication has been disabled

Correct Answer: 2. The supported upgrade path, release notes, backup, and maintenance plan

Explanation:

Firmware upgrades should follow the supported upgrade path and vendor guidance. Administrators should review release notes for behavior changes, known issues, resolved defects, and compatibility considerations. A current backup should be created, and a maintenance plan should include validation and recovery procedures. High-availability environments may require additional sequencing considerations. Deleting logs or dismantling production configuration is not a normal prerequisite and can make troubleshooting more difficult.

Question 307.

After a FortiWeb upgrade, HTTPS connections to one backend application fail. What should be reviewed FIRST?

1. User desktop configuration
2. Printer settings
3. Backend TLS configuration, certificates, trust settings, and upgrade notes
4. IP reputation categories

Correct Answer: 3. Backend TLS configuration, certificates, trust settings, and upgrade notes

Explanation:

If HTTPS failures begin immediately after a firmware upgrade, administrators should review the relevant TLS configuration, certificate trust, cipher or protocol compatibility, and any upgrade notes describing changed behavior. Logs can help identify whether certificate validation, protocol negotiation, or another TLS issue is responsible. The backend server should also be tested directly where appropriate. Unrelated endpoint settings do not explain a FortiWeb-to-backend HTTPS failure. Structured analysis is preferable to disabling certificate validation without understanding the cause.

Question 308.

Which operational practice BEST reduces risk during a production FortiWeb upgrade?

1. Upgrade without a maintenance window
2. Disable application monitoring
3. Remove all health checks
4. Use a controlled upgrade plan with testing, validation, and recovery options**

Correct Answer: 4. Use a controlled upgrade plan with testing, validation, and recovery options

Explanation:

A controlled upgrade process reduces the chance that unexpected behavior becomes a prolonged outage. Administrators should use a supported upgrade path, maintain a current backup, schedule the work appropriately, validate critical applications after completion, and know how to recover if necessary. Testing in a nonproduction environment is valuable when available. Post-upgrade checks should include policies, TLS, backend health, logging, load balancing, and management access. Careful preparation is particularly important for appliances operating directly in the production traffic path.

Question 309.

A SOC wants to correlate FortiWeb attacks with user authentication and endpoint events. Which configuration is MOST useful?

1. Forward FortiWeb logs to a centralized SIEM
2. Increase session persistence
3. Disable local logging
4. Increase server pool weights

Correct Answer: 1. Forward FortiWeb logs to a centralized SIEM

Explanation:

A SIEM can combine FortiWeb events with authentication, endpoint, firewall, server, and other security data. This allows analysts to determine whether an application attack is part of a broader incident and to build more meaningful alerts and timelines. Centralized logging also supports historical analysis and reporting. Local FortiWeb logging can remain enabled as appropriate. Load balancing and persistence do not provide the cross-platform event correlation needed by a security operations team.

Question 310.

Why should FortiWeb, backend servers, and a SIEM use synchronized time sources?

1. To increase application throughput
2. To make event timelines accurate across systems
3. To disable expired certificates
4. To improve file upload performance

Correct Answer: 2. To make event timelines accurate across systems

Explanation:

Accurate timestamps are essential when administrators reconstruct an incident that spans multiple systems. If FortiWeb, backend servers, identity platforms, and the SIEM have significantly different clocks, the sequence of events can appear incorrect or confusing. Reliable time synchronization improves log correlation, troubleshooting, compliance reporting, and security investigations. Accurate time can also affect certificate validation and scheduled operations. Time synchronization is therefore a basic operational requirement for an integrated security environment.

Question 311.

A FortiWeb deployment generates many attack events, but only critical events should wake an on-call engineer. What should be configured?

1. Severity-based alerting and notification thresholds
2. Server persistence
3. Load balancing
4. HTTP request rewriting only

Correct Answer: 1. Severity-based alerting and notification thresholds

Explanation:

Not every logged event requires immediate human action. Alerting should be tuned so critical or otherwise actionable events generate notifications, while lower-priority activity remains available for analysis and reporting. This reduces alert fatigue and helps on-call personnel focus on significant threats. Administrators should review thresholds periodically because attack patterns and business priorities can change. Detailed event logging should still be retained according to operational and security requirements even when only selected events generate alerts.

Question 312.

The SOC receives repetitive alerts for benign automated monitoring traffic. What is the BEST response?

1. Disable FortiWeb completely
2. Validate the traffic and tune the relevant alert or bot policy narrowly
3. Disable all logs
4. Block every automated client

Correct Answer: 2. Validate the traffic and tune the relevant alert or bot policy narrowly

Explanation:

Legitimate monitoring systems and service integrations can generate automated traffic that resembles bot activity. Administrators should first confirm that the source and behavior are legitimate, then tune the relevant policy or alert criteria as narrowly as possible. A specific allow or exception may be appropriate depending on the implementation. Broadly disabling bot protection or logging would reduce security for unrelated traffic. The objective is to remove unnecessary alert noise without creating a large security gap.

Question 313.

A server pool has four members, but one member receives twice as many requests as the others. Which configuration should be examined?

1. Data leak prevention
2. Attack signatures
3. Load-balancing method, member weights, and persistence
4. IP reputation

Correct Answer: 3. Load-balancing method, member weights, and persistence

Explanation:

Traffic imbalance can be caused by configured weights, the selected load-balancing algorithm, active session persistence, or changes in member health. A server with a larger weight may intentionally receive more requests, while persistent sessions can keep users attached to one member for extended periods. Administrators should review server pool statistics and settings before treating the imbalance as a fault. Security controls such as DLP or signatures do not normally determine how legitimate requests are divided among healthy backend systems.

Question 314.

A backend server is marked down because the health check receives an HTTP redirect instead of the expected response. What should the administrator do?

1. Disable all web protection
2. Delete the server pool
3. Increase signature sensitivity
4. Adjust the health check so its expected behavior matches the application**

Correct Answer: 4. Adjust the health check so its expected behavior matches the application

Explanation:

Health checks must be designed around the actual application behavior. If a URL now redirects, a check expecting a different status or content may incorrectly mark a healthy server as unavailable. The administrator should verify that the redirect is legitimate and then update the health-check logic appropriately. Accurate health monitoring is essential because false failures can reduce available backend capacity. The goal is not to weaken WAF security but to ensure the availability test accurately reflects whether the application can serve users.

Question 315.

A temporary signature exception has not been triggered for several months. What should the administrator do?

1. Review whether the exception is still needed and remove it if obsolete
2. Expand the exception to more URLs
3. Disable the signature globally
4. Keep the exception permanently without review

Correct Answer: 1. Review whether the exception is still needed and remove it if obsolete

Explanation:

Exceptions should be treated as controlled deviations from the normal security policy. If an exception has not been used for a long period, the administrator should verify whether the original application issue still exists. Application updates may have resolved the false positive or removed the affected functionality. If the exception is no longer required, removing it restores full protection and simplifies policy management. Low usage alone is not absolute proof that an exception is unnecessary, so validation with the application owner is appropriate before removal.

Question 316.

A company needs to investigate attacks that occurred four months ago. Which FortiWeb operational practice is MOST important?

1. Review only active sessions
2. Maintain sufficient log retention or centralized historical storage
3. Delete logs weekly
4. Disable external log forwarding

Correct Answer: 2. Maintain sufficient log retention or centralized historical storage

Explanation:

Historical investigations depend on retained logs. If events are deleted before an incident is discovered, administrators may lose critical evidence about source addresses, targeted applications, matched signatures, and policy actions. Centralized logging can provide additional storage, search, correlation, and retention capabilities beyond the appliance itself. Retention periods should be aligned with organizational requirements, security needs, and storage capacity. Long-term visibility is important for incident response, compliance, and attack trend analysis.

Question 317.

An exception created for one request parameter accidentally weakens protection for an entire URL. What should the administrator do?

1. Narrow the exception to the exact legitimate parameter or condition
2. Leave the broad exception in place
3. Disable all signatures on the application
4. Stop reviewing logs

Correct Answer: 1. Narrow the exception to the exact legitimate parameter or condition

Explanation:

Security exceptions should be as precise as possible. If an exception intended for one parameter affects the entire URL, malicious requests targeting other fields may bypass protection unnecessarily. The administrator should use logs to identify the exact legitimate request condition and refine the exception accordingly. Afterward, testing should verify that the false positive is resolved while malicious variants remain blocked. Narrow scope minimizes security impact and makes exceptions easier to review and retire later.

Question 318.

A new application version introduces WebSocket functionality and new API routes. What should the FortiWeb administrator do?

1. Assume the old policy automatically covers every new behavior correctly
2. Review supported application behavior and update relevant protection policies
3. Disable FortiWeb for the new application version
4. Delete previous logs

Correct Answer: 2. Review supported application behavior and update relevant protection policies

Explanation:

Application releases can introduce new protocols, paths, request formats, methods, and traffic patterns. FortiWeb policies should be reviewed whenever application behavior changes significantly. Administrators should understand the new functionality, verify that the deployment mode and FortiWeb version support the required behavior, and update relevant access controls, protocol settings, signatures, and behavioral models. Monitoring during rollout can reveal false positives or protection gaps. WAF security is most effective when it evolves alongside the application it protects.

Question 319.

A critical application is about to receive a stricter web protection profile. Which rollout method is BEST?

1. Validate with representative traffic, review logs, tune the profile, then expand enforcement
2. Enable maximum blocking immediately
3. Disable logging during the rollout
4. Remove health checks first

Correct Answer: 1. Validate with representative traffic, review logs, tune the profile, then expand enforcement

Explanation:

A staged deployment reduces the risk of false positives causing a production outage. Representative traffic should include authentication, APIs, uploads, administrative workflows, common requests, and less frequent legitimate activity. Administrators can review FortiWeb logs to determine whether restrictions are behaving as expected and tune the policy before broad blocking. Once the profile has been validated, enforcement can be expanded confidently. Immediate global blocking may cause unnecessary disruption, while disabling logs removes the evidence needed to diagnose problems.

Question 320.

Which statement BEST describes mature FortiWeb security operations?

1. Focus only on attack signatures
2. Use shared administrator accounts to simplify access
3. Keep every exception indefinitely
4. Combine secure management, backups, controlled upgrades, centralized logging, backend monitoring, application-aware tuning, and periodic policy review**

Correct Answer: 4. Combine secure management, backups, controlled upgrades, centralized logging, backend monitoring, application-aware tuning, and periodic policy review

Explanation:

A mature FortiWeb environment combines web application protection with disciplined operational practices. Administrative access should be restricted and auditable, while configuration backups and planned upgrades improve recoverability. Centralized logging strengthens monitoring and incident response, and backend statistics and health checks support availability. Protection profiles, bot controls, protocol limits, behavioral models, and exceptions should be reviewed whenever applications change. Periodic policy review also removes obsolete settings and security gaps. This continuous lifecycle approach keeps FortiWeb aligned with both current application behavior and evolving threats.