View Full Fortinet NSE5_FWB_AD-8.0 Exam Dumps and Practice Test Dumps

 

Question 221. A FortiWeb administrator wants to prevent clients from using the TRACE HTTP method against a public-facing application because the application does not require it. Which configuration should be considered?

1. Disable backend health checks
2. Configure HTTP method restrictions
3. Enable response caching
4. Configure session persistence

Correct Answer: 2. Configure HTTP method restrictions

Explanation :-

HTTP method restrictions allow administrators to define which request methods an application is permitted to receive. If an application does not require TRACE, the administrator can restrict that method while continuing to allow legitimate methods such as GET and POST. Limiting unnecessary HTTP methods can reduce the application’s exposed attack surface and prevent unsupported requests from reaching the backend. Backend health checks are used to monitor server availability, response caching improves content delivery, and session persistence maintains client affinity. The administrator should first confirm the application’s legitimate method requirements so that security restrictions do not unintentionally break required functionality.

Question 222. A company has multiple backend servers, but one server should receive a larger proportion of traffic because it has greater processing capacity. Which configuration concept is most appropriate?

1. Weighted load balancing
2. URL access control
3. Geographic filtering
4. HTTP header validation

Correct Answer: 1. Weighted load balancing

Explanation :-

Weighted load balancing allows traffic distribution to account for differences in backend server capacity. A server with greater processing capability can be assigned a higher weight so that it receives a larger proportion of requests than a lower-capacity server. This can provide a more appropriate distribution than treating every backend equally. URL access control restricts access to application paths, geographic filtering controls traffic according to location, and HTTP header validation examines request information. Administrators should monitor backend performance after configuring weights and adjust them according to actual capacity and application workload rather than relying solely on theoretical specifications.

Question 223. A protected web application uses a cookie to maintain authenticated sessions. The administrator wants to reduce the possibility that client-side scripts can directly access this session cookie. Which attribute is most relevant?

1. Domain
2. Path
3. HttpOnly
4. Expires

Correct Answer: 3. HttpOnly

Explanation :-

The HttpOnly cookie attribute instructs compatible browsers not to make the cookie directly accessible through ordinary client-side scripting APIs. This is particularly relevant for authentication and session cookies because reducing script access can limit exposure in certain cross-site scripting scenarios. The Domain attribute controls which hosts can receive the cookie, Path determines the URL path scope, and Expires controls its lifetime. HttpOnly is therefore the attribute most directly associated with limiting client-side script access to a session cookie. Administrators should also consider Secure and appropriate SameSite settings where supported and applicable to the application’s authentication design.

Question 224. A FortiWeb administrator wants to protect a backend application from requests containing parameters with unexpected formats, such as letters where only numeric values are expected. Which capability is most appropriate?

1. Data validation
2. HTTP caching
3. Server persistence
4. Geographic IP filtering

Correct Answer: 1. Data validation

Explanation :-

Data validation allows FortiWeb to evaluate whether application input conforms to expected formats, types, or values. If a parameter is expected to contain only numeric information, a validation rule can help identify or reject requests containing unexpected characters. This reduces the amount of malformed or potentially malicious input reaching the backend application. HTTP caching addresses content delivery, server persistence maintains client-to-server affinity, and geographic filtering controls access based on client location. Administrators should build validation rules from the application’s documented input requirements and test them carefully so that legitimate values are accepted while malformed requests are appropriately handled.

Question 225. A company wants FortiWeb to inspect uploaded documents and prevent files containing known malicious content from reaching the application server. Which feature is most directly applicable?

1. API discovery
2. Antivirus scanning
3. HTTP method filtering
4. Session persistence

Correct Answer: 2. Antivirus scanning

Explanation :-

Antivirus scanning can inspect uploaded content for known malicious files before those files are passed to the backend application, depending on the configured FortiWeb inspection profile and supported file types. This is particularly important for applications that allow users to upload documents, images, archives, or other files. API discovery identifies API behavior, HTTP method filtering restricts request methods, and session persistence controls backend affinity. File-upload security should also consider file-size limits, permitted file types, application-specific validation, and the possibility of emerging threats that may not yet have known signatures.

Question 226. A FortiWeb administrator notices that legitimate requests containing SQL-like syntax are being blocked by a SQL injection rule. What should be done before creating a broad exception?

1. Disable all SQL injection protection
2. Remove the affected backend server
3. Examine the matched signature and verify the legitimate application behavior
4. Disable security logging

Correct Answer: 3. Examine the matched signature and verify the legitimate application behavior

Explanation :-

A SQL injection rule may occasionally identify legitimate application input that resembles an attack pattern. Before creating an exception, the administrator should inspect the security event, determine which signature or rule matched, and verify that the request is genuinely required by the application. If the behavior is legitimate, a narrowly scoped tuning action may be appropriate after testing. Disabling SQL injection protection globally would unnecessarily reduce security, while removing a backend server or disabling logging does not address the inspection issue. Careful analysis helps preserve protection against actual injection attempts while minimizing disruption to legitimate application functionality.

Question 227. A web application is accessible through several domain names, but each domain should present its own TLS certificate. Which technology helps FortiWeb select the appropriate certificate during the TLS handshake?

1. Server health checking
2. Session persistence
3. SNI
4. HTTP caching

Correct Answer: 3. SNI

Explanation :-

Server Name Indication, or SNI, allows the TLS client to provide the requested hostname during the TLS handshake. FortiWeb can use this hostname to determine which certificate and HTTPS configuration should be presented when multiple secure domains share the same IP address. This is particularly useful for environments hosting several HTTPS applications on common infrastructure. Health checks determine backend availability, session persistence controls client affinity, and caching affects content delivery. Administrators should ensure that certificates correctly cover their intended hostnames and that the corresponding virtual-server configuration is consistent with the domains being protected.

Question 228. A FortiWeb administrator wants to ensure that a backend server is considered healthy only when a specific application URL returns the expected HTTP status code. Which setting is most appropriate?

1. Custom application health check
2. Cookie persistence
3. URL rewriting
4. HTTP compression

Correct Answer: 1. Custom application health check

Explanation :-

A custom application health check can test a specific URI and evaluate the response to determine whether a backend application is functioning as expected. This is more meaningful than simply checking whether the server accepts a network connection when application-level availability is the actual requirement. The administrator can configure the health-check target and expected response according to the application’s design. Cookie persistence controls which backend receives a client session, URL rewriting modifies request paths, and HTTP compression affects data transmission. A carefully designed application health check can prevent FortiWeb from sending normal traffic to a server whose application service is unavailable.

Question 229. A security administrator wants to identify previously unknown APIs used by applications protected by FortiWeb. Which capability can assist with this task?

1. API discovery
2. HTTP response caching
3. Backend TLS re-encryption
4. Geographic filtering

Correct Answer: 1. API discovery

Explanation :-

API discovery helps administrators identify API endpoints and understand API traffic observed by FortiWeb. This can be useful in environments where application teams have deployed APIs without maintaining a complete inventory. An accurate API inventory can support subsequent protection activities such as request validation, schema enforcement, authentication controls, and monitoring. Response caching improves delivery performance, backend TLS re-encryption protects traffic between FortiWeb and servers, and geographic filtering controls access based on location. Administrators should review discovered APIs against the organization’s expected application architecture and investigate unexpected endpoints before deciding how they should be protected.

Question 230. A company wants to limit requests from a client that repeatedly exceeds an acceptable request threshold. Which FortiWeb capability directly addresses the request frequency?

1. Certificate management
2. Rate limiting
3. URL rewriting
4. Server certificate validation

Correct Answer: 2. Rate limiting

Explanation :-

Rate limiting controls how frequently requests can be accepted from clients or other defined traffic sources. It can help reduce excessive application-layer traffic and protect backend resources from clients generating unusually high request volumes. Administrators should establish thresholds based on normal application behavior and monitor the resulting events to avoid unnecessarily affecting legitimate users. Certificate management and validation concern TLS security, while URL rewriting changes request paths or destinations. Rate limiting can also complement bot management and denial-of-service controls when excessive traffic is associated with automated or abusive activity.

Question 231. A FortiWeb administrator has configured a WAF signature in blocking mode but wants to first understand how often it matches legitimate traffic. What should the administrator review?

1. Security events and matched-rule logs
2. Backend disk partitions
3. Client desktop settings
4. DNS mail-exchange records

Correct Answer: 1. Security events and matched-rule logs

Explanation :-

Security events and matched-rule logs provide visibility into requests that trigger WAF signatures. Reviewing these events can help the administrator determine the frequency of matches, affected URLs or parameters, source information, and the specific rule responsible. This is especially important when evaluating whether a signature is producing false positives before changing its configuration. Backend disk partitions, client desktop settings, and DNS mail-exchange records do not provide relevant information about WAF matching. Administrators should use the available logging details to distinguish legitimate application behavior from actual attack traffic and make narrowly targeted tuning decisions when necessary.

Question 232. A web application should only be reachable from a defined set of trusted client IP addresses. Which FortiWeb feature can enforce this requirement?

1. HTTP caching
2. IP-based access control
3. Backend load balancing
4. API schema discovery

Correct Answer: 2. IP-based access control

Explanation :-

IP-based access control allows administrators to define which source IP addresses or address ranges may access a protected application. This can be useful for administrative portals, partner applications, internal services, or other resources that should not be publicly accessible. The administrator should carefully maintain the permitted address list because legitimate users connecting through changing networks or proxies may otherwise be denied. HTTP caching affects content delivery, load balancing distributes traffic among backend servers, and API discovery identifies API endpoints. IP restrictions are most effective when combined with authentication and other application security controls where appropriate.

Question 233. A FortiWeb administrator wants to ensure that clients cannot directly access a backend server and bypass the security controls provided by FortiWeb. What network design principle is important?

1. Allow unrestricted public access to every backend server
2. Disable all backend firewall restrictions
3. Ensure backend servers are reachable through the intended FortiWeb path rather than directly from untrusted clients
4. Place all backend servers on public DNS without restrictions

Correct Answer: 3. Ensure backend servers are reachable through the intended FortiWeb path rather than directly from untrusted clients

Explanation :-

A reverse-proxy security architecture is effective only when clients cannot simply bypass the proxy and connect directly to the protected backend. Backend servers should therefore be placed and filtered so that external clients are required to use the intended FortiWeb path. Network controls such as firewall rules and appropriate segmentation can reinforce this architecture. Allowing unrestricted public access to backend systems could let attackers bypass WAF, authentication, rate limiting, and other FortiWeb protections. Administrators should verify both network reachability and application configuration when validating that the protected architecture cannot be circumvented.

Question 234. A company wants to protect a web application from automated clients that behave differently from normal browsers and generate suspicious request patterns. Which FortiWeb capability should be evaluated?

1. Bot management
2. Certificate renewal
3. Backend HTTPS
4. HTTP caching

Correct Answer: 1. Bot management

Explanation :-

Bot management provides controls for identifying and handling automated traffic according to configured detection mechanisms. Suspicious automation can consume application resources, perform credential attacks, scrape content, or generate abnormal request patterns. FortiWeb can use bot-related controls to challenge, monitor, rate-limit, or block traffic depending on the configuration and detected behavior. Certificate renewal addresses TLS validity, backend HTTPS protects the connection to application servers, and caching improves content delivery. Administrators should account for legitimate automated clients such as monitoring systems, integrations, and search engines when tuning bot policies to reduce false positives.

Question 235. A FortiWeb administrator needs to protect an application that communicates with backend servers using HTTPS. The administrator wants FortiWeb to verify the identity of those backend servers. What should be configured?

1. HTTP response caching
2. Backend certificate trust validation
3. Client IP persistence
4. URL rewriting

Correct Answer: 2. Backend certificate trust validation

Explanation :-

When FortiWeb establishes HTTPS connections to backend servers, validating the backend certificate helps ensure that FortiWeb is communicating with the intended server and that the TLS connection meets the configured trust requirements. The administrator should configure the appropriate trusted certificates or certificate authorities and verify that backend certificates are valid and correctly issued. HTTP caching does not provide server identity validation, persistence controls traffic affinity, and URL rewriting changes request paths. Proper backend certificate validation is especially important when traffic is re-encrypted between FortiWeb and application servers.

Question 236. A security administrator wants to reduce the exposure of an application by blocking access to an unused administrative URL. Which FortiWeb control should be considered?

1. Session persistence
2. URL access control
3. HTTP caching
4. Backend health checking

Correct Answer: 2. URL access control

Explanation :-

URL access control can restrict requests to specified application paths. If an administrative URL is unused or should not be exposed to public clients, the administrator can configure a rule that denies access to that path. This reduces the externally accessible application surface and can help prevent unauthorized attempts to interact with administrative functionality. Session persistence controls backend affinity, caching improves content delivery, and health checks determine whether backend servers are available. Administrators should confirm that the URL is genuinely unused or restricted before blocking it and should monitor logs for legitimate clients that may still depend on the resource.

Question 237. A FortiWeb administrator is investigating why a newly configured security policy does not appear to affect traffic. Which factor should be checked early in the investigation?

1. The administrator’s workstation wallpaper
2. The backend monitor size
3. Policy order and matching conditions
4. The browser’s bookmark list

Correct Answer: 3. Policy order and matching conditions

Explanation :-

Policy order and matching conditions are important when determining which FortiWeb policy processes a request. If an earlier policy matches the traffic, a later policy may never be reached, depending on the configured processing logic. The administrator should therefore review source and destination criteria, virtual server or hostname matching, URL conditions, HTTP attributes, policy order, and other applicable matching parameters. Workstation appearance, monitor size, and browser bookmarks are irrelevant to FortiWeb policy processing. Reviewing the actual request and corresponding logs can help confirm which policy handled the traffic and explain why the expected security configuration was not applied.

Question 238. A web application has a known legitimate URL parameter that contains characters commonly associated with command injection patterns. What is the safest initial approach when a command-injection rule creates false positives?

1. Disable command-injection protection for all applications
2. Delete the security policy
3. Verify the legitimate parameter behavior and narrowly tune the affected rule if justified
4. Disable all FortiWeb logging

Correct Answer: 3. Verify the legitimate parameter behavior and narrowly tune the affected rule if justified

Explanation :-

A command-injection signature may occasionally match legitimate input containing characters that resemble shell or operating-system commands. The administrator should first verify that the request is genuinely expected and understand exactly why the security rule matched. If the behavior is legitimate and unavoidable, a narrowly scoped tuning action or exception may be considered after testing. Disabling command-injection protection globally would unnecessarily reduce protection against actual attacks. Deleting the policy or disabling logging also removes security controls and visibility. The goal should be to accommodate verified legitimate application behavior while retaining command-injection protection for unrelated requests.

Question 239. A FortiWeb administrator wants to preserve security visibility after sending logs to a centralized logging platform. What should the administrator ensure?

1. Logging is correctly configured and relevant security events are being forwarded
2. All local security logging is permanently disabled
3. Every backend server uses the same operating system
4. HTTP caching is enabled for every response

Correct Answer: 1. Logging is correctly configured and relevant security events are being forwarded

Explanation :-

Centralized logging can improve security monitoring, correlation, investigation, and long-term event retention. The administrator should verify that FortiWeb is correctly configured to forward the required logs and that the centralized platform is actually receiving and interpreting them. Important event categories, severity levels, filters, and connectivity should be reviewed so that useful security information is not unintentionally excluded. Disabling local logging without verifying centralized delivery can create a visibility gap. Backend operating systems and HTTP caching do not determine whether security events are successfully forwarded. Regular validation of the logging pipeline helps maintain reliable security monitoring.

Question 240. A FortiWeb administrator wants to introduce a new WAF policy for a production application while minimizing the risk of disrupting legitimate users. Which approach is most appropriate?

1. Immediately block every request matching the new rules
2. Disable existing WAF protection first
3. Delete all existing application security profiles
4. Test and monitor the new rules, review events for false positives, then apply enforcement as appropriate

Correct Answer: 4. Test and monitor the new rules, review events for false positives, then apply enforcement as appropriate

Explanation :-

Introducing new WAF rules should be performed in a controlled manner. Monitoring and testing allow administrators to observe how the rules interact with legitimate application traffic and identify potential false positives before stronger enforcement is applied. Security events can reveal affected URLs, parameters, signatures, and client behavior, helping administrators tune rules where necessary. Immediately blocking all matches may disrupt legitimate users, while disabling existing WAF controls or deleting security profiles unnecessarily reduces protection. A staged approach provides useful evidence and allows the administrator to validate the configuration before enforcing it more aggressively in production.