View Full Fortinet FCP_FWF_AD-7.4 Exam Dumps and Practice Test Dumps

 

Question 161.

A FortiWeb administrator wants to prevent users from directly reaching backend application servers from the internet. Which deployment model BEST supports this requirement?

1. Reverse proxy mode
2. Offline monitoring mode
3. Packet capture mode
4. DNS-only mode

Correct Answer: 1. Reverse proxy mode

Explanation:

In reverse proxy mode, clients connect to FortiWeb rather than directly to protected backend servers. FortiWeb terminates the client connection, applies security controls, and then establishes a separate connection to the appropriate backend server. This architecture hides backend addressing from external users and enables extensive application-layer inspection. It also supports features such as TLS termination, re-encryption, load balancing, session persistence, health checking, and authentication integration. Reverse proxy mode is therefore well suited to environments where FortiWeb should act as the controlled entry point for web applications.

Question 162.

A backend server is reachable but its application process has stopped responding correctly. Which FortiWeb configuration is MOST useful for detecting this condition?

1. IP reputation
2. An application-aware HTTP or HTTPS health check
3. Session persistence
4. Signature exception

Correct Answer: 2. An application-aware HTTP or HTTPS health check

Explanation:

A network-level check may show that the server is reachable even though the actual web application is unavailable. An HTTP or HTTPS health check can request a specific application resource and verify an expected response. If the application does not return the expected result, FortiWeb can mark the server unhealthy and stop forwarding new traffic to it. This prevents users from being directed to a server that is technically online but functionally unavailable. Health checks should be designed to test the actual service users depend on.

Question 163.

A web application requires each authenticated user to remain connected to the same backend server. Which FortiWeb feature should be configured?

1. Data leak prevention
2. Web attack signatures
3. Session persistence
4. IP reputation

Correct Answer: 3. Session persistence

Explanation:

Session persistence keeps requests from the same client or application session associated with the same backend server. This is important for applications that store session state locally instead of using a centralized or shared session database. Without persistence, load balancing might direct later requests to a different server, causing lost state or unexpected logouts. FortiWeb can use an appropriate persistence method based on how the application tracks users. Persistence is primarily an application-delivery function and works alongside load balancing and health checking.

Question 164.

Why would an administrator configure TLS encryption between FortiWeb and backend servers after FortiWeb has already decrypted client traffic?

1. To prevent FortiWeb from inspecting requests
2. To eliminate certificate management
3. To disable load balancing
4. To protect data in transit on the internal network**

Correct Answer: 4. To protect data in transit on the internal network

Explanation:

FortiWeb can terminate the client-side TLS connection for inspection and then create a separate encrypted TLS connection to the backend. This protects sensitive application data across the internal network segment as well as across the public-facing connection. Backend encryption may be required by security policy or compliance requirements, especially when internal networks are not fully trusted. Administrators should configure certificate verification appropriately. This architecture allows FortiWeb to inspect traffic while still maintaining encryption on both connection legs.

Question 165.

A protected application should never receive more than 100 HTTP headers in a request. Which FortiWeb control is MOST appropriate?

1. HTTP protocol constraints
2. Session persistence
3. Server load balancing
4. IP reputation

Correct Answer: 1. HTTP protocol constraints

Explanation:

Protocol constraints allow FortiWeb to enforce expected structural characteristics of HTTP requests, including limits related to headers, request size, methods, and other protocol elements. If an application never requires more than a defined number of headers, enforcing a reasonable maximum can help reject malformed or abusive requests before they reach the backend. Thresholds should be tested against legitimate traffic because overly restrictive settings may create false positives. Protocol validation works well alongside web attack signatures and behavioral protection.

Question 166.

An API supports GET, POST, PUT, and DELETE but never uses TRACE. Which configuration BEST reduces attack surface?

1. Allow all HTTP methods
2. Permit required methods and block TRACE
3. Disable method inspection
4. Convert TRACE to POST

Correct Answer: 2. Permit required methods and block TRACE

Explanation:

Allowing only methods required by the application follows the principle of least functionality. If TRACE has no legitimate business purpose, blocking it reduces unnecessary functionality exposed to clients. Administrators should verify all API workflows before enforcement so valid methods are not blocked accidentally. HTTP method control is only one layer of defense and should be combined with authentication, authorization, signatures, protocol validation, and secure API development. Removing unnecessary functionality helps reduce opportunities for misuse.

Question 167.

Which FortiWeb capability is MOST directly responsible for identifying known SQL injection patterns?

1. Server persistence
2. Health checking
3. Web attack signatures
4. Load balancing

Correct Answer: 3. Web attack signatures

Explanation:

Web attack signatures inspect HTTP and HTTPS traffic for known malicious patterns associated with common application-layer attacks, including SQL injection. When a matching pattern is detected, FortiWeb can log, alert, or block the request depending on the configured policy. Signature-based detection provides strong coverage for known threats but should be supplemented with behavioral analysis, protocol validation, access controls, and secure coding practices. Delivery features such as load balancing and persistence do not inspect request payloads for injection attacks.

Question 168.

A legitimate request triggers one FortiWeb signature only when a specific parameter contains a certain format. What is the BEST response?

1. Disable all web protection
2. Disable the entire signature category
3. Bypass the application
4. Create a narrowly scoped exception for the validated condition**

Correct Answer: 4. Create a narrowly scoped exception for the validated condition

Explanation:

A false positive should be corrected with the smallest possible policy change. The administrator should verify that the traffic is legitimate and identify the exact signature, URL, parameter, and request condition involved. A narrowly scoped exception preserves the signature’s protection for other parts of the application while allowing the valid request. Broadly disabling a signature category or bypassing FortiWeb would create unnecessary exposure. Exceptions should also be documented and reviewed periodically as the application evolves.

Question 169.

What is the main reason to use machine-learning or behavioral protection together with signatures?

1. To detect abnormal traffic that may not match known attack patterns
2. To eliminate the need for backend servers
3. To disable application logging
4. To automatically fix application source code

Correct Answer: 1. To detect abnormal traffic that may not match known attack patterns

Explanation:

Signatures are highly effective against recognized attack patterns, while behavioral or machine-learning protection can identify requests that differ significantly from learned legitimate behavior. This provides an additional layer against customized or previously unseen attacks. The model should be trained using representative application traffic and carefully reviewed before strict blocking. Behavioral protection does not replace signatures, secure coding, authentication, or monitoring. Its value comes from extending detection beyond known static patterns and providing anomaly-based analysis.

Question 170.

A FortiWeb machine-learning model has just completed initial learning. What should the administrator do before enabling strict blocking?

1. Disable all attack signatures
2. Review anomalies and verify the model includes representative legitimate traffic
3. Delete the backend pool
4. Disable logs

Correct Answer: 2. Review anomalies and verify the model includes representative legitimate traffic

Explanation:

Initial learning may not include every valid workflow, API operation, scheduled task, or administrative action. Before enabling blocking, administrators should examine what the model considers abnormal and confirm that legitimate but less common behavior has been represented. Additional learning or tuning may be required. Moving directly to blocking can create false positives and application disruption. A staged approach of learning, monitoring, validating, and then enforcing provides a safer transition while preserving the benefits of behavioral protection.

Question 171.

A login page is being targeted by automated scripts attempting many usernames and passwords. Which FortiWeb controls are MOST useful?

1. Bot mitigation and rate limiting
2. Server health checks only
3. Static routing only
4. Session persistence only

Correct Answer: 1. Bot mitigation and rate limiting

Explanation:

Automated authentication attacks such as credential stuffing and brute-force attempts rely on repeated scripted requests. Bot mitigation helps identify automated clients, while rate limiting reduces the number of requests that can reach the login endpoint over a given period. Administrators should tune thresholds carefully to avoid affecting legitimate users, especially when traffic originates through shared networks. These controls should be combined with multifactor authentication, secure passwords, account monitoring, and application-side protections for stronger defense.

Question 172.

A sensitive management URL should be available only to requests coming from an internal administrative subnet. Which control is BEST?

1. Increase request size limits
2. Source-based URL access control
3. Disable HTTPS inspection
4. Increase server pool weight

Correct Answer: 2. Source-based URL access control

Explanation:

Source-based URL access control can limit a sensitive application path to approved IP networks. This prevents requests from untrusted external sources from reaching the management interface while allowing traffic from the designated administrative subnet. The application should still require strong authentication because source address alone is not sufficient proof of identity. Restricting sensitive paths by network location reduces attack surface and provides another layer of protection beyond application login controls.

Question 173.

An organization wants to immediately prevent access to a deprecated /old-api path without changing the backend application. Which FortiWeb feature is MOST appropriate?

1. Session persistence
2. Load balancing
3. URL access rules
4. TLS offloading

Correct Answer: 3. URL access rules

Explanation:

URL access rules allow FortiWeb to control how requests to specific paths are handled. Administrators can deny access to /old-api even if the backend resource has not yet been removed. This is useful during migrations or decommissioning when an obsolete endpoint must be blocked quickly. Logs can be monitored for continued attempts to reach the retired path. Ultimately, the backend functionality should also be removed so the WAF is not the only barrier protecting an unnecessary application endpoint.

Question 174.

A FortiWeb administrator wants to detect sensitive data such as payment card numbers in application responses. Which feature is MOST relevant?

1. Session persistence
2. Load balancing
3. Server health checks
4. Data leak prevention**

Correct Answer: 4. Data leak prevention

Explanation:

Data leak prevention can inspect application responses for patterns associated with sensitive information. This helps identify accidental exposure caused by application errors, overly broad API responses, or improper data handling. Depending on policy, FortiWeb may log, alert, mask, or otherwise act when protected information is detected. DLP should be tuned carefully to avoid false positives and should complement strong authorization, secure coding, and data minimization. The application should ultimately be designed to avoid returning unnecessary sensitive data.

Question 175.

An upload form should accept only PNG images smaller than 4 MB. What is the BEST FortiWeb configuration?

1. Allow only the required file type and enforce an appropriate size limit
2. Accept every file type
3. Disable request inspection
4. Increase persistence timeout

Correct Answer: 1. Allow only the required file type and enforce an appropriate size limit

Explanation:

Upload controls should match legitimate business requirements as closely as possible. If the application only requires PNG images under 4 MB, other file types and oversized files should be rejected. This reduces opportunities for malicious file uploads, resource abuse, and unnecessary content exposure. Malware-related inspection can provide an additional layer where appropriate. The backend application should independently verify uploads and store them safely. An allowlist-based policy provides stronger security than accepting all content by default.

Question 176.

Why should administrators avoid using IP reputation as the only FortiWeb security control?

1. IP reputation cannot be used with HTTPS
2. Source addresses can change, be shared, or fail to represent the nature of each request
3. Reputation works only for internal clients
4. Reputation prevents signature inspection

Correct Answer: 2. Source addresses can change, be shared, or fail to represent the nature of each request

Explanation:

IP reputation provides useful context, but a source address is not always a reliable indicator of request intent. Legitimate users may share public addresses through NAT or proxies, while attackers can move between cloud systems or compromised hosts. Reputation should therefore be combined with signatures, behavioral analysis, bot mitigation, authentication, protocol validation, and rate controls. A layered approach gives FortiWeb multiple signals to evaluate and reduces dependence on any one source characteristic.

Question 177.

After a major web application update, FortiWeb begins blocking requests containing several new parameters. What should the administrator review FIRST?

1. FortiWeb logs together with the application’s changed request behavior
2. Printer configuration
3. Server rack labels
4. Desktop wallpaper

Correct Answer: 1. FortiWeb logs together with the application’s changed request behavior

Explanation:

Major application updates often introduce new URLs, parameters, methods, body formats, APIs, and workflows. Existing FortiWeb protections may interpret those changes as malicious or anomalous because they were not present previously. Administrators should examine the logs to identify which rules or signatures are triggering and compare the requests with the documented application changes. The relevant signatures, exceptions, protocol constraints, or machine-learning models can then be tuned. Broadly disabling protection should be avoided because the problem is usually limited to specific new behavior.

Question 178.

A new version of an API introduces a different JSON schema, causing valid requests to be flagged as anomalies. What is the BEST response?

1. Disable all FortiWeb protections
2. Retrain or retune the behavioral model using validated new API traffic
3. Block all API clients
4. Disable logging permanently

Correct Answer: 2. Retrain or retune the behavioral model using validated new API traffic

Explanation:

Behavioral models reflect the traffic patterns on which they were trained. A changed JSON schema may make legitimate new requests appear abnormal compared with the previous API version. Administrators should confirm that the new behavior is expected and allow the model to learn the updated traffic pattern. Monitoring should continue until the revised model is stable enough for enforcement. This approach maintains anomaly detection while adapting to legitimate application evolution rather than permanently disabling behavioral security.

Question 179.

A FortiWeb administrator wants to apply a highly restrictive policy to a production application with minimal disruption. Which rollout method is BEST?

1. Test against representative traffic, monitor results, tune the policy, then enforce broadly
2. Enable maximum blocking globally immediately
3. Disable logging before deployment
4. Remove FortiWeb from the traffic path during testing

Correct Answer: 1. Test against representative traffic, monitor results, tune the policy, then enforce broadly

Explanation:

A staged rollout reduces the risk that false positives or configuration errors will cause widespread application outages. Administrators should evaluate the policy using representative traffic that includes normal users, APIs, uploads, authentication, administrative functions, and less common valid requests. Logs can then reveal unexpected blocks and guide tuning. Once the policy has been validated, enforcement can be expanded confidently. Immediate maximum blocking creates avoidable operational risk, while disabling logs removes the information required for troubleshooting.

Question 180.

Which statement BEST describes a mature FortiWeb administration model?

1. Configure FortiWeb once and leave it unchanged
2. Depend only on signatures
3. Disable monitoring after deployment
4. Continuously manage application behavior, layered protections, backend health, certificates, logs, exceptions, and policy tuning**

Correct Answer: 4. Continuously manage application behavior, layered protections, backend health, certificates, logs, exceptions, and policy tuning

Explanation:

A mature FortiWeb deployment is continuously maintained because applications, APIs, certificates, backend servers, and threats change over time. Administrators should monitor attack and traffic logs, maintain server pools and health checks, update certificates, review signature and behavioral policies, tune bot and protocol controls, and reassess exceptions. New application releases may introduce URLs or request formats requiring policy updates, while obsolete rules should be removed. Continuous administration keeps protection aligned with legitimate application behavior while reducing both false positives and security gaps.