View Full Fortinet NSE5_FWB_AD-8.0 Exam Dumps and Practice Test Dumps

 

Question 201. A FortiWeb administrator wants to ensure that a protected application accepts only requests addressed to the expected hostname. Which configuration is most relevant?

1. Enable HTTP response caching
2. Configure backend session persistence
3. Increase the server health-check interval
4. Configure the virtual server with the appropriate host or domain matching

Correct Answer: 4. Configure the virtual server with the appropriate host or domain matching

Explanation :-

Hostname matching helps FortiWeb associate incoming requests with the correct protected application and security policy. When multiple applications share infrastructure, the requested hostname can be an important factor in determining which virtual server or policy should process the traffic. The administrator should verify that the configured domain or Host-header criteria correspond to the application’s legitimate hostname. Health-check intervals determine backend availability, caching affects content delivery, and session persistence maintains client affinity. None of those controls directly establish which hostname is accepted for an application. Correct hostname configuration also helps prevent unintended requests from being processed by the wrong virtual server or policy.

Question 202. A web application uses a URL containing encoded characters, and security inspection behaves differently depending on how the URL is encoded. Which issue should the administrator investigate?

1. Certificate expiration
2. URL normalization and canonicalization
3. Backend load-balancing algorithm
4. Server persistence timeout

Correct Answer: 2. URL normalization and canonicalization

Explanation :-

URL normalization and canonicalization help FortiWeb interpret equivalent URL representations consistently before security controls are applied. Attackers can sometimes manipulate encoding, path representation, or other URL characteristics to attempt to bypass security rules. If identical resources produce different inspection results depending on encoding, the administrator should investigate how FortiWeb normalizes and evaluates those requests. Load-balancing algorithms determine backend selection, certificate expiration affects TLS validation, and persistence timeouts concern session affinity. Proper URL normalization helps ensure that access-control and security rules operate on the effective request rather than an ambiguous or manipulated representation.

Question 203. An administrator needs to prevent users from accessing administrative application paths through a public-facing website. Which FortiWeb control is most appropriate?

1. URL access control
2. Backend TLS re-encryption
3. HTTP response compression
4. Server health checking

Correct Answer: 1. URL access control

Explanation :-

URL access control can restrict access to specific application paths based on configured rules. If administrative URLs should not be accessible through a public-facing application, the administrator can define appropriate restrictions for those paths. This can reduce exposure of sensitive application functions and help enforce the intended access model. Response compression improves transmission efficiency, health checks determine backend availability, and TLS re-encryption protects traffic between FortiWeb and backend servers. URL access controls should be designed carefully so that legitimate application resources remain available while sensitive paths are restricted according to the organization’s security requirements.

Question 204. A FortiWeb administrator wants backend traffic to remain encrypted after FortiWeb terminates the client’s HTTPS connection. Which configuration supports this design?

1. URL rewriting
2. Client IP persistence
3. HTTP caching
4. HTTPS communication from FortiWeb to the backend servers

Correct Answer: 4. HTTPS communication from FortiWeb to the backend servers

Explanation :-

When FortiWeb terminates the client’s TLS connection but must also protect traffic across the internal network, it can establish HTTPS communication with the backend servers. This design provides encryption on both the client-to-FortiWeb and FortiWeb-to-server portions of the connection. The administrator must ensure that the backend certificate and trust configuration are appropriate for the HTTPS connection. HTTP caching does not provide transport encryption, client persistence controls backend affinity, and URL rewriting modifies request routing or paths. Backend HTTPS is therefore the appropriate configuration when end-to-end encrypted transport is required across both connection segments.

Question 205. A web application requires a specific security rule to inspect only requests targeting /checkout. Which configuration principle should the administrator follow?

1. Disable URL inspection for the entire virtual server
2. Scope the security configuration to the required URL or application context
3. Remove all URL-related policies
4. Apply the rule broadly to every URL

Correct Answer: 2. Scope the security configuration to the required URL or application context

Explanation :-

Security controls should be scoped as precisely as the application requirement allows. If a rule is intended to inspect requests to /checkout, applying it specifically to that URL or the appropriate application context reduces unintended effects on unrelated functionality. Broadly applying a rule may cause unnecessary false positives or application disruption, while disabling URL inspection removes useful protection. Removing URL policies would further reduce control over application access. Administrators should understand how FortiWeb policy and URL matching interact and test the configuration with both legitimate and malicious requests before deploying it to production.

Question 206. A company wants to protect users from a session cookie being transmitted without security attributes. Which cookie settings should the administrator consider?

1. DNS and MX records
2. Round-robin and least-connections settings
3. Secure and HttpOnly attributes
4. Health-check URI and response code

Correct Answer: 3. Secure and HttpOnly attributes

Explanation :-

The Secure attribute helps ensure that a cookie is transmitted only over HTTPS, reducing the risk of exposing the cookie through an unencrypted connection. The HttpOnly attribute prevents ordinary client-side scripts from directly accessing the cookie, which can reduce exposure in certain cross-site scripting scenarios. Administrators should apply cookie security controls according to the application’s compatibility requirements. Load-balancing settings determine backend distribution, DNS and MX records concern name and mail services, and health-check settings determine backend availability. Cookie protection is particularly important for authentication and session identifiers because compromise of these values can allow unauthorized session use.

Question 207. A FortiWeb policy is blocking a legitimate request because a WAF signature detects a parameter value that is expected by the application. What should the administrator inspect first?

1. The exact signature, parameter, and request that triggered the match
2. The client’s browser bookmarks
3. The backend server’s display configuration
4. The appliance’s physical power settings

Correct Answer: 1. The exact signature, parameter, and request that triggered the match

Explanation :-

When a WAF signature causes a suspected false positive, the administrator should first identify precisely what FortiWeb detected. Reviewing the security event and examining the matched signature, parameter, URL, and request content helps determine whether the application behavior is legitimate and why the rule triggered. This information is necessary before changing a signature or creating an exception. Disabling broad WAF protection without understanding the event can create unnecessary exposure. Physical appliance settings, backend display configuration, and browser bookmarks do not provide useful information about the security match. Detailed event analysis should precede any tuning decision.

Question 208. An API accepts JSON requests containing a field named quantity. The application expects this field to be a positive integer. Which control can help enforce this requirement at the security gateway?

1. HTTP caching
2. Data or API parameter validation
3. Backend certificate renewal
4. Geographic access control

Correct Answer: 2. Data or API parameter validation

Explanation :-

Parameter validation allows FortiWeb to enforce expected data types, formats, and values for application inputs. If an API expects quantity to be a positive integer, validation can help reject requests containing invalid values, unexpected formats, or potentially malicious input before the request reaches the backend. This provides an additional layer of input validation and can reduce reliance on the application alone to reject malformed requests. HTTP caching does not validate input, geographic access controls determine access based on location, and certificate renewal is related to TLS identity. Validation rules should be aligned with the API specification and tested against legitimate client behavior.

Question 209. A web application becomes unavailable whenever one backend server stops responding, even though other servers in the pool remain healthy. What should the administrator verify?

1. Whether backend health checks are correctly detecting failed servers
2. Whether the client uses the correct screen resolution
3. Whether the WAF has no signatures enabled
4. Whether browser caching is disabled

Correct Answer: 1. Whether backend health checks are correctly detecting failed servers

Explanation :-

Health checks allow FortiWeb to determine whether backend servers are available before directing traffic to them. If a failed server remains in the active pool, requests may continue to be sent to it, causing application failures even though other servers are healthy. The administrator should verify the health-check method, destination, interval, timeout, and expected response, depending on the application’s design. Browser caching and screen resolution are unrelated to backend availability, while disabling WAF signatures would not solve a failed-server selection problem. Proper health monitoring allows FortiWeb to remove unhealthy servers from normal traffic distribution.

Question 210. A security team wants FortiWeb to challenge suspicious automated clients while allowing normal human users to continue with minimal interruption. Which capability is designed for this purpose?

1. HTTP response caching
2. Certificate chain replacement
3. Bot management and mitigation
4. Static URL rewriting

Correct Answer: 3. Bot management and mitigation

Explanation :-

Bot management and mitigation can help FortiWeb identify and control automated traffic according to configured detection and response mechanisms. Depending on the configuration, suspicious clients may be challenged, rate-limited, or blocked, while trusted or normal traffic can continue. This provides more granular control than simply blocking all automated requests. URL rewriting changes request paths, certificate configuration manages TLS identity, and caching improves delivery performance. Administrators should tune bot controls according to the application’s legitimate automation requirements because search engines, monitoring systems, integrations, and other trusted services may also generate automated requests.

Question 211. A FortiWeb administrator wants to inspect HTTPS traffic for a protected application. Which prerequisite is essential for TLS termination at FortiWeb?

1. A valid server certificate and corresponding private key
2. A client-side persistence cookie
3. A configured HTTP cache
4. A backend DNS MX record

Correct Answer: 1. A valid server certificate and corresponding private key

Explanation :-

For FortiWeb to terminate HTTPS connections, it must have an appropriate server certificate and the corresponding private key. The certificate establishes the server identity presented to clients, while the private key enables the cryptographic operations required during TLS negotiation. Administrators should also verify the certificate chain, hostname coverage, validity period, and trust requirements. An MX record is related to mail routing, HTTP caching concerns content delivery, and a persistence cookie is used for session affinity. Without the correct certificate and private key, FortiWeb cannot properly provide TLS termination for the protected HTTPS service.

Question 212. A company wants to restrict access to an application based on the geographic origin of client IP addresses. Which FortiWeb capability is relevant?

1. API schema generation
2. Backend response caching
3. Geographic IP access control
4. HTTP compression

Correct Answer: 3. Geographic IP access control

Explanation :-

Geographic IP access control can use geolocation information associated with client IP addresses to permit or deny traffic according to configured geographic criteria. Organizations may use this capability when application access is expected only from particular countries or regions. Administrators should recognize that IP geolocation is not perfectly precise and should consider legitimate users who may connect through VPNs, proxies, cloud services, or other infrastructure. HTTP compression and caching concern application delivery, while API schema generation is unrelated to geographic access decisions. Geographic controls should therefore be treated as one layer within a broader access-control strategy.

Question 213. A FortiWeb administrator notices that security events are being generated, but the team cannot determine which application policy processed the traffic. Which logging information should be reviewed?

1. The browser’s bookmark list
2. The backend monitor resolution
3. The administrator’s desktop wallpaper
4. Policy, virtual server, and security-rule information associated with the event

Correct Answer: 4. Policy, virtual server, and security-rule information associated with the event

Explanation :-

FortiWeb security and traffic logs can provide context about how a request was processed. When troubleshooting policy behavior, administrators should review information such as the virtual server, policy, security profile, matched rule, action, source details, and request characteristics where available. This information can help determine whether the request reached the expected policy and which security control generated the event. Desktop appearance, browser bookmarks, and monitor resolution have no relevance to FortiWeb policy processing. Accurate logging is particularly important in environments with multiple virtual hosts and security policies because similar traffic may be handled differently depending on the matching conditions.

Question 214. A company wants to protect a web application from clients that repeatedly submit requests at a rate significantly higher than normal user behavior. Which combination can provide additional protection?

1. URL rewriting and DNS forwarding
2. TLS certificate renewal and HTTP caching
3. Rate limiting and application-layer DoS protection
4. Server certificate import and cookie deletion

Correct Answer: 3. Rate limiting and application-layer DoS protection

Explanation :-

Excessive request rates can consume application resources and contribute to application-layer denial-of-service conditions. Rate limiting can restrict request frequency, while application-layer DoS controls can provide additional protection against abnormal traffic patterns according to configured thresholds. The administrator should establish thresholds based on legitimate traffic characteristics to reduce the chance of disrupting normal users. TLS certificate management protects encrypted connections, caching improves content delivery, URL rewriting changes request paths, and DNS forwarding concerns name resolution. Combining appropriate request-rate controls with broader DoS protections can provide a layered approach to managing excessive application traffic.

Question 215. A FortiWeb administrator needs to preserve the client’s original IP information when traffic is forwarded to an application server. Which consideration is important?

1. The forwarding configuration and trusted proxy headers must be correctly designed
2. The server pool must contain exactly one server
3. The application must use only FTP
4. HTTP caching must always be disabled

Correct Answer: 1. The forwarding configuration and trusted proxy headers must be correctly designed

Explanation :-

When traffic passes through a reverse proxy, the backend application may otherwise see the proxy’s address instead of the original client address. Depending on the deployment, FortiWeb can use appropriate forwarding headers so the backend can identify the original client source. The application and any intermediate infrastructure must be configured to trust and correctly process those headers; otherwise, clients could potentially spoof source information. Caching, FTP, and the number of servers in a pool do not directly solve this requirement. Administrators should carefully define which headers are trusted and ensure that the backend only accepts client-identity information from trusted proxy infrastructure.

Question 216. A security administrator wants to verify whether a recently configured WAF rule is detecting attacks without immediately blocking legitimate production traffic. Which action mode is most suitable for initial validation?

1. Remove the virtual server
2. Disable all logging
3. Permanent policy deletion
4. Monitor or detection mode

Correct Answer: 4. Monitor or detection mode

Explanation :-

Monitor or detection mode allows an administrator to observe how a security rule responds to traffic without immediately enforcing a blocking action, depending on the FortiWeb configuration and policy behavior. This can be useful when introducing new rules into production because the administrator can evaluate legitimate traffic, identify potential false positives, and review security events before moving to stronger enforcement. Deleting policies or disabling logging removes useful protection and visibility. Removing the virtual server would disrupt the protected service entirely. After sufficient validation, administrators can determine whether a blocking action is appropriate based on the observed traffic and application requirements.

Question 217. A FortiWeb administrator wants to reduce the amount of sensitive information exposed through application error responses. Which security consideration is most relevant?

1. Changing the load-balancing algorithm
2. Controlling and reviewing HTTP response information
3. Exposing detailed backend errors directly to clients
4. Increasing backend server disk capacity

Correct Answer: 2. Controlling and reviewing HTTP response information

Explanation :-

Detailed application errors can sometimes reveal internal paths, technologies, database information, configuration details, or other data useful to attackers. Administrators should review how the protected application handles error responses and ensure that unnecessary internal information is not exposed to external clients. Depending on the deployment, FortiWeb can contribute to controlling or inspecting HTTP traffic and application behavior. Increasing disk capacity or changing the load-balancing algorithm does not address information disclosure through responses. Administrators should also coordinate with application developers because the backend application should ideally generate safe, user-facing error messages rather than exposing debugging information.

Question 218. A FortiWeb administrator is configuring an application that has four backend servers with different processing capacities. Sending the same number of requests to each server would overload the smallest server. Which load-balancing consideration is most appropriate?

1. Disable TLS on the client side
2. Configure the distribution method according to backend capacity
3. Use URL rewriting to equalize CPU usage
4. Disable all health checks

Correct Answer: 2. Configure the distribution method according to backend capacity

Explanation :-

Backend servers with different processing capabilities may require a load-balancing method that accounts for their relative capacity rather than treating every server identically. FortiWeb administrators should select and configure an appropriate load-balancing strategy, including weights where supported by the deployment, so that higher-capacity servers can receive an appropriate proportion of traffic. Disabling health checks could cause failed servers to receive traffic, while URL rewriting and client-side TLS settings do not determine how backend workload is distributed. The administrator should also monitor actual server utilization and application response behavior to confirm that the selected distribution method matches operational requirements.

Question 219. A security team wants to use FortiAI capabilities to assist with interpreting security information collected by FortiWeb. What is an appropriate use of such assistance?

1. Remove all application logs to reduce data volume
2. Automatically replace every security policy without review
3. Use AI-assisted analysis to help interpret security events while retaining administrator validation
4. Disable all WAF signatures after AI analysis

Correct Answer: 3. Use AI-assisted analysis to help interpret security events while retaining administrator validation

Explanation :-

FortiAI-related capabilities can assist administrators with analyzing or interpreting security information, depending on the available FortiWeb functionality and configured integrations. Such assistance can help identify patterns, summarize information, or support investigation, but administrators should validate recommendations against actual traffic, application behavior, and organizational security requirements before making configuration changes. Automatically replacing policies or disabling security controls without review could introduce unnecessary risk. Removing logs would also eliminate valuable evidence needed for investigation. AI assistance should therefore complement, rather than replace, established security monitoring, verification, and change-control processes.

Question 220. During troubleshooting, FortiWeb correctly receives client traffic but the backend application returns errors. Which sequence provides a useful starting point for diagnosis?

1. Change all certificates regardless of their status
2. Review the backend connection, server health, policy action, and relevant traffic/security logs
3. Delete the security policy, disable logging, then restart every backend server
4. Disable every WAF and DoS feature before collecting evidence

Correct Answer: 2. Review the backend connection, server health, policy action, and relevant traffic/security logs

Explanation :-

When FortiWeb receives traffic successfully but the application returns backend errors, troubleshooting should proceed systematically. The administrator should verify that the selected backend server is healthy and reachable, confirm the relevant policy action, and inspect traffic and security logs for evidence of blocked, modified, or otherwise affected requests. Backend TLS settings, request transformations, authentication behavior, and server responses may then be examined as indicated by the evidence. Disabling all security controls or changing certificates without diagnosis can create new problems and remove useful protection. A structured approach helps isolate whether the issue originates at FortiWeb, the connection to the backend, or the application itself.