View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 41.

An administrator wants FortiWeb to inspect client traffic without terminating the client connection as a reverse proxy. Which deployment consideration is MOST relevant?

1. Use a transparent deployment mode that fits the network design
2. Disable all application inspection
3. Configure FortiWeb only as a DNS server
4. Replace the backend web servers

Correct Answer: 1. Use a transparent deployment mode that fits the network design

Explanation:

FortiWeb supports deployment options that can fit environments where reverse proxy termination is not desired or practical. Transparent deployment allows FortiWeb to be inserted into the traffic path while minimizing addressing changes to the protected infrastructure. The exact capabilities available can vary by mode, so administrators should select the deployment method based on required inspection, network topology, SSL handling, and application-delivery features. Reverse proxy mode generally provides the richest feature set, but transparent deployment can reduce architectural changes. The key is to understand which FortiWeb functions are supported in the chosen mode before production rollout.

Question 42.

A FortiWeb server pool contains three members, but one member stops responding to the configured health check. What should FortiWeb normally do?

1. Continue sending the same amount of traffic to the failed server
2. Stop sending new traffic to the unhealthy member until it recovers
3. Delete the server permanently
4. Disable all server pool members

Correct Answer: 2. Stop sending new traffic to the unhealthy member until it recovers

Explanation:

Health checks allow FortiWeb to determine whether backend servers are capable of serving application traffic. If one member fails the configured health check, FortiWeb can temporarily remove it from active load-balancing decisions and distribute new requests among the remaining healthy members. Once the failed server passes the health check again, it can be returned to service automatically. This improves application availability and prevents users from being directed to a backend that is not functioning correctly. Health checks should be application-aware where practical so they validate actual service health rather than merely network reachability.

Question 43.

An administrator wants to distribute requests across backend servers based on a configured load-balancing method. Which object is MOST directly involved?

1. Attack log
2. IP reputation category
3. Server pool
4. Signature exception

Correct Answer: 3. Server pool

Explanation:

A server pool groups the backend servers that can receive requests for a protected application. FortiWeb can use the configured pool and its load-balancing method to determine which healthy backend member should receive each request. Health checks and session persistence can also influence server selection. Attack logs and reputation categories are security functions rather than backend distribution objects. Proper server pool design is important for both scalability and availability, especially when the protected application runs across multiple servers.

Question 44.

A stateful application requires users to remain on the same backend server throughout their session. Which FortiWeb capability is MOST appropriate?

1. Web attack signatures
2. Data leak prevention
3. IP reputation
4. Session persistence**

Correct Answer: 4. Session persistence

Explanation:

Session persistence keeps requests associated with the same client or application session directed to the same backend server. This can be important for applications that store session information locally on each server rather than in a shared datastore. Without persistence, a user’s requests might be distributed among different servers, potentially causing authentication failures, lost application state, or inconsistent behavior. The selected persistence method should match how the application identifies sessions. Persistence is an application-delivery function and is separate from security controls such as attack signatures, DLP, and IP reputation.

Question 45.

An administrator terminates HTTPS on FortiWeb and forwards the decrypted request to the backend using HTTP. What is the main operational benefit?

1. Reduced TLS processing workload on backend servers
2. Elimination of all application vulnerabilities
3. Removal of the need for certificates
4. Prevention of all bot traffic

Correct Answer: 1. Reduced TLS processing workload on backend servers

Explanation:

When FortiWeb performs TLS termination and forwards traffic to the backend using HTTP, the backend servers no longer need to perform the client-side TLS encryption and decryption workload for those sessions. This is commonly called SSL or TLS offloading. It can centralize certificate handling and reduce cryptographic processing on application servers. However, administrators must evaluate the security of the internal network segment because traffic between FortiWeb and the backend is no longer encrypted. If confidentiality is required end to end, FortiWeb can instead establish a separate encrypted connection toward the backend.

Question 46.

Why might an administrator configure FortiWeb to use HTTPS when connecting to backend servers?

1. To disable application inspection
2. To preserve confidentiality between FortiWeb and the backend
3. To prevent health checks
4. To bypass web protection profiles

Correct Answer: 2. To preserve confidentiality between FortiWeb and the backend

Explanation:

Using HTTPS on the backend connection protects application data while it travels from FortiWeb to the web server. This can be important in environments where the internal network is not considered fully trusted or where compliance requirements mandate encryption in transit. FortiWeb can terminate the client-side TLS session for inspection and then create a separate encrypted session to the backend. Administrators should configure appropriate certificate validation and trust settings rather than simply encrypting without verification. Backend HTTPS does not prevent FortiWeb from applying web security controls to the decrypted client request.

Question 47.

A FortiWeb administrator wants to reject excessively long HTTP headers that are not expected by the application. Which control is MOST relevant?

1. Static routing
2. Load balancing
3. HTTP protocol constraints
4. Server persistence

Correct Answer: 3. HTTP protocol constraints

Explanation:

Protocol constraints can enforce limits on HTTP elements such as header lengths, request sizes, methods, and other structural characteristics. These controls help reject malformed or abnormal requests before they reach the protected application. Excessive headers may be used in denial-of-service attempts, parser attacks, or exploitation of application weaknesses. The limits should be tuned to legitimate traffic so normal clients are not blocked. Protocol validation complements signature-based detection by enforcing expected request structure rather than relying solely on known attack patterns.

Question 48.

A web application supports only GET and POST requests. Which policy approach BEST follows least functionality?

1. Allow every HTTP method
2. Disable HTTP inspection
3. Convert all methods to GET
4. Permit only the methods the application actually requires**

Correct Answer: 4. Permit only the methods the application actually requires

Explanation:

Restricting HTTP methods to those actually used by the application reduces unnecessary functionality exposed to clients. If the application requires only GET and POST, allowing additional methods such as PUT, DELETE, or TRACE can create avoidable attack opportunities. Administrators should confirm legitimate application behavior before enforcing restrictions, especially for APIs or administrative workflows. Method restrictions should be one component of layered security that also includes authorization, signatures, behavioral protection, and secure coding. This approach follows the principle of exposing only the functionality necessary for business operations.

Question 49.

A FortiWeb signature detects a known command-injection pattern in an HTTP parameter. What should FortiWeb do when the policy action is configured to block?

1. Prevent the malicious request from reaching the backend application
2. Forward the request unchanged
3. Disable the backend server
4. Delete the application database

Correct Answer: 1. Prevent the malicious request from reaching the backend application

Explanation:

When a request matches a configured web attack signature and the action is set to block, FortiWeb should stop the request before it reaches the protected application. This is the core purpose of inline web application firewall enforcement. The event should also be logged so administrators can investigate the source, URL, parameter, matched signature, and other context. Blocking a request is different from taking the backend server offline or altering application data. Signature protection is most effective when combined with secure coding, behavioral controls, protocol validation, and regular policy tuning.

Question 50.

A signature is generating false positives only for one specific parameter on one URL. What is the BEST response?

1. Disable all signatures globally
2. Create a narrowly scoped exception for the affected parameter after validation
3. Remove FortiWeb from the traffic path
4. Allow all traffic from the user’s IP address

Correct Answer: 2. Create a narrowly scoped exception for the affected parameter after validation

Explanation:

A carefully scoped exception can resolve a false positive without disabling protection for the rest of the application. The administrator should first validate that the request is legitimate and understand why the signature is triggered. The exception can then be limited to the specific URL, parameter, signature, or other relevant context. Broad exclusions or global signature disablement would create unnecessary exposure. Exceptions should be documented and periodically reviewed because application behavior may change and an exception that was once necessary may later become obsolete.

Question 51.

What is the PRIMARY benefit of combining FortiWeb signatures with behavioral or machine-learning protection?

1. It provides coverage for both known attack patterns and abnormal application behavior
2. It removes the need for backend servers
3. It eliminates the need for logging
4. It guarantees zero false positives

Correct Answer: 1. It provides coverage for both known attack patterns and abnormal application behavior

Explanation:

Attack signatures are effective at identifying known malicious patterns, while behavioral or machine-learning controls can detect unusual requests that do not match an existing signature. Combining the two provides broader coverage against both established and evolving application-layer threats. Behavioral controls require learning and tuning so normal application traffic is modeled accurately. Neither approach guarantees zero false positives or eliminates the need for secure coding and operational monitoring. Layered protection is valuable because different detection techniques can compensate for limitations in one another.

Question 52.

Why should administrators avoid immediately enabling strict blocking for a newly learned application model?

1. It prevents TLS certificates from loading
2. It disables server pools
3. The model may not yet represent all legitimate application behavior
4. It prevents FortiWeb from logging events

Correct Answer: 3. The model may not yet represent all legitimate application behavior

Explanation:

A newly created behavioral model may initially be based on an incomplete sample of traffic. Some legitimate workflows may occur only periodically, for certain users, through APIs, or during maintenance windows. If strict enforcement begins too early, those valid requests may appear anomalous and be blocked. Administrators should observe the learned model, review detections, and ensure representative traffic has been captured before moving to stronger enforcement. A staged transition from learning to monitoring and then blocking can reduce false positives while preserving the value of behavioral protection.

Question 53.

An application login endpoint is experiencing credential-stuffing attempts from automated clients. Which combination is MOST appropriate?

1. Bot mitigation and rate limiting
2. Static routing and DHCP relay
3. Server persistence and DNS caching
4. Disabling HTTPS and logging

Correct Answer: 1. Bot mitigation and rate limiting

Explanation:

Credential stuffing relies heavily on automation and repeated authentication attempts using previously compromised credentials. Bot mitigation can help identify automated behavior, while rate limiting can reduce the volume of attempts reaching the login application. Administrators should tune thresholds to avoid affecting legitimate users, especially behind shared proxies or NAT devices. These controls are strongest when paired with multifactor authentication, secure password practices, account monitoring, and application-level protections. Network routing and server persistence do not directly address automated login abuse.

Question 54.

An administrator wants only a trusted corporate network to reach a sensitive management URL on a protected web application. Which control is MOST appropriate?

1. Increase request limits
2. Apply a source-based access rule to the sensitive URL
3. Disable web attack signatures
4. Configure session persistence

Correct Answer: 2. Apply a source-based access rule to the sensitive URL

Explanation:

Source-based access rules can restrict sensitive application paths so that only approved network ranges are permitted to connect. This can significantly reduce exposure for management interfaces, administrative portals, or other resources that do not need public access. Source filtering should complement strong authentication because network location alone is not a sufficient identity control. Administrators should account for legitimate VPN or remote-access paths when defining allowed sources. This approach is more appropriate than changing request limits or disabling security controls because it directly reduces who can reach the sensitive URL.

Question 55.

A web application has several legacy URLs that should no longer be accessible. Which FortiWeb feature can help enforce this requirement?

1. URL access control
2. Server health checking
3. TLS offloading only
4. Load balancing

Correct Answer: 1. URL access control

Explanation:

URL access control allows administrators to define how requests to specific paths are treated. Legacy or deprecated application paths can be denied so clients cannot reach functionality that should no longer be exposed. This can reduce attack surface and help organizations retire old interfaces even if backend files or routes still exist temporarily. Administrators should verify that the URLs are genuinely obsolete before blocking them and monitor logs for continued access attempts. URL access rules complement application cleanup and secure development but do not replace proper removal of unnecessary backend functionality.

Question 56.

A FortiWeb administrator wants to detect sensitive data accidentally returned in an HTTP response. Which capability is MOST relevant?

1. Load balancing
2. Data leak prevention
3. Static routing
4. Session persistence

Correct Answer: 2. Data leak prevention

Explanation:

Data leak prevention can inspect web responses for patterns associated with sensitive information. Depending on policy, FortiWeb can alert, mask, or otherwise act when protected data is detected. This can help identify accidental exposure of confidential information through application errors, excessive API responses, or poorly implemented pages. DLP should be tuned carefully because broad patterns can generate false positives. It is an additional protective layer and should be combined with proper authorization, secure application development, database controls, and data minimization.

Question 57.

An application accepts document uploads but should never receive executable files. What is the BEST FortiWeb policy approach?

1. Restrict permitted upload file types and inspect uploads where appropriate
2. Allow every file type
3. Disable request inspection
4. Increase the number of backend servers

Correct Answer: 1. Restrict permitted upload file types and inspect uploads where appropriate

Explanation:

If the application has a defined business need for documents, administrators should allow only the file types and sizes required by that workflow. Blocking executable or unnecessary formats reduces the chance that users can upload dangerous content. Malware-related inspection can provide another layer where supported. The backend application should also store uploaded files securely and avoid executing them directly. File restrictions should be based on actual application requirements rather than trusting extensions alone. Allowing unrestricted uploads creates unnecessary risk and increases the attack surface.

Question 58.

Why should IP reputation be used as one component of a layered FortiWeb security policy rather than the only protection mechanism?

1. IP addresses can change, be shared, or fail to represent the true nature of every request
2. IP reputation cannot be logged
3. Reputation works only for backend servers
4. Reputation disables TLS

Correct Answer: 1. IP addresses can change, be shared, or fail to represent the true nature of every request

Explanation:

IP reputation can provide valuable context about sources associated with malicious or suspicious activity, but it is not perfect. Attackers can change addresses, legitimate users may share infrastructure, and cloud or proxy services can make source reputation less definitive. For this reason, reputation should be combined with application signatures, behavioral analysis, bot controls, authentication, protocol validation, and request context. Layered security reduces dependence on any single signal and provides more accurate protection across changing traffic conditions.

Question 59.

An administrator wants to understand exactly why FortiWeb blocked a request. Which data source should be checked FIRST?

1. FortiWeb attack or event logs
2. Physical server labels
3. User desktop configuration
4. Printer usage history

Correct Answer: 1. FortiWeb attack or event logs

Explanation:

FortiWeb logs record the enforcement decision and often include information such as the source address, destination, URL, matched security rule or signature, severity, action, and other request details. This makes them the primary troubleshooting source when investigating blocked traffic. Administrators can use logs to distinguish real attacks from false positives and determine whether tuning or an exception is appropriate. Strong logging practices are also important for threat analysis, compliance, and incident investigation. Unrelated endpoint or physical infrastructure data generally does not explain a WAF policy decision.

Question 60.

Which statement BEST describes effective FortiWeb administration over time?

1. Deploy once and never change the configuration
2. Disable logs after the first week
3. Use only signatures and ignore application behavior
4. Continuously monitor traffic, tune policies, review exceptions, validate backend health, and adapt protection as applications change**

Correct Answer: 4. Continuously monitor traffic, tune policies, review exceptions, validate backend health, and adapt protection as applications change

Explanation:

FortiWeb administration is an ongoing process because applications, APIs, certificates, backend servers, traffic patterns, and threats continually change. Administrators should review logs, tune security controls, validate machine-learning behavior, maintain signatures, monitor backend health, and reassess exceptions. Application updates may introduce new URLs, parameters, methods, or false positives that require policy adjustment. Server pool changes and certificate renewals also require operational attention. Regular review ensures protection remains effective without unnecessarily disrupting legitimate users. A mature deployment combines security monitoring, application knowledge, controlled tuning, and lifecycle management rather than treating the initial configuration as permanent.