View Full Fortinet NSE5_FWB_AD-8.0 Exam Dumps and Practice Test Dumps

 

Question 341. Which FortiWeb feature allows an administrator to discover API endpoints by analyzing application traffic before creating API protection rules?

1. API discovery
2. Static routing
3. Web cache
4. SSL offloading

Correct Answer: 1. API discovery

Explanation :-

API discovery analyzes observed application traffic to identify API endpoints and their characteristics. This capability helps administrators understand which APIs are actually being used before defining more specific protection policies. Instead of manually entering every endpoint, administrators can use discovered information as a basis for creating API protection rules. This is particularly useful in environments where APIs are numerous, frequently updated, or poorly documented. Static routing, web caching, and SSL offloading perform different networking or application-delivery functions and do not provide API endpoint discovery. API discovery therefore supports a more informed and structured approach to protecting web APIs with FortiWeb.

Question 342. An administrator wants FortiWeb to protect a web application from SQL injection attacks. Which security feature should be configured?

1. IP reputation
2. HTTP protocol constraints
3. Signature-based protection
4. Server load balancing

Correct Answer: 3. Signature-based protection

Explanation :-

FortiWeb uses attack signatures to identify known patterns associated with threats such as SQL injection. When a request matches a configured SQL injection signature, FortiWeb can take the action specified by the associated policy, such as blocking or logging the request. Signature-based protection is therefore an important component of web application security against recognized attack patterns. IP reputation focuses on identifying potentially malicious source addresses, while HTTP protocol constraints enforce valid protocol behavior. Server load balancing distributes traffic among backend servers and does not itself detect SQL injection attempts. Properly configured signatures provide a targeted mechanism for identifying common web application attacks.

Question 343. Which FortiWeb component is responsible for determining how matching security events should be handled, such as blocking, monitoring, or allowing traffic?

1. Certificate
2. Action
3. Backend server
4. DNS record

Correct Answer: 2. Action

Explanation :-

In FortiWeb security policies, the configured action determines what FortiWeb does when traffic matches the relevant security condition. Depending on the feature and policy configuration, an action can instruct FortiWeb to block, alert, log, or otherwise handle matching traffic. This separation between detection and response allows administrators to decide how aggressively a security control should be enforced. Certificates provide cryptographic identity for secure connections, backend servers receive application requests, and DNS records provide name-resolution information. None of these directly determines the response to a detected security event. Selecting an appropriate action is therefore an important part of implementing effective FortiWeb protection policies.

Question 344. Which FortiWeb feature can help identify whether a client IP address is associated with known malicious activity?

1. IP reputation
2. URL rewriting
3. HTTP compression
4. Web cache

Correct Answer: 1. IP reputation

Explanation :-

IP reputation evaluates client IP addresses against reputation information associated with known malicious or suspicious activity. FortiWeb can use this information as part of its security decision-making process to identify potentially hostile sources before they reach protected applications. This can help reduce exposure to traffic originating from known bad addresses. URL rewriting modifies requested URLs, HTTP compression changes how content is transferred, and web caching improves content delivery by storing frequently requested resources. These features do not primarily evaluate the reputation of source IP addresses. IP reputation is therefore the appropriate FortiWeb capability for this requirement.

Question 345. An administrator needs to terminate HTTPS connections at FortiWeb and then forward decrypted HTTP traffic to backend servers. Which function provides this capability?

1. Web application firewall signatures
2. SSL/TLS offloading
3. IP reputation
4. Cookie security

Correct Answer: 2. SSL/TLS offloading

Explanation :-

SSL/TLS offloading allows FortiWeb to terminate encrypted client connections and handle the cryptographic processing at the FortiWeb device. After the HTTPS session is terminated, FortiWeb can inspect the decrypted application traffic and forward it toward backend servers according to the configured deployment and security policies. This can also enable security inspection that would otherwise be difficult to perform on encrypted traffic. Web application firewall signatures detect application-layer threats, IP reputation evaluates source addresses, and cookie security protects session-related information. SSL/TLS offloading is therefore the appropriate function when FortiWeb must terminate HTTPS connections before forwarding traffic to application servers.

Question 346. Which FortiWeb deployment mode places the appliance inline so that traffic passes through FortiWeb before reaching the protected server?

1. Offline monitoring
2. Reverse proxy
3. Packet capture
4. Log-only mode

Correct Answer: 2. Reverse proxy

Explanation :-

In reverse-proxy deployment, FortiWeb is positioned between clients and backend application servers and receives client requests on behalf of those servers. It can inspect the requests, apply configured security controls, and then forward permitted traffic to the appropriate backend system. This inline architecture allows FortiWeb to actively enforce web application security policies rather than simply observe traffic. Offline monitoring and packet capture are primarily associated with visibility or analysis, while log-only behavior does not describe the fundamental traffic architecture. Reverse proxy deployment is therefore commonly used when FortiWeb must actively inspect and control traffic destined for protected web applications.

Question 347. What is the primary purpose of a FortiWeb server policy?

1. To define the relationship between incoming traffic and protected web servers
2. To configure FortiGate routing tables
3. To manage administrator passwords
4. To create DNS zones

Correct Answer: 1. To define the relationship between incoming traffic and protected web servers

Explanation :-

A FortiWeb server policy determines how incoming client traffic is associated with a protected application or backend server configuration. It provides the framework through which FortiWeb can receive requests, apply relevant protection settings, and forward permitted traffic to the appropriate destination. This makes server policies a key component of a reverse-proxy deployment. FortiGate routing tables belong to routing functions on FortiGate, administrator password management is part of administrative security, and DNS zones are handled by DNS services. Understanding server policies is important because they connect client-facing traffic with the protected application infrastructure and associated FortiWeb security controls.

Question 348. Which FortiWeb capability helps prevent attackers from using automated tools to repeatedly submit requests to a protected application?

1. Rate limiting
2. DNS forwarding
3. Certificate enrollment
4. Static routing

Correct Answer: 1. Rate limiting

Explanation :-

Rate limiting controls how frequently requests can be sent to a protected application or resource. By restricting excessive request rates, FortiWeb can reduce the impact of automated activity such as abusive clients, request floods, and certain forms of application-layer denial-of-service behavior. Rate limits can be designed around specific traffic characteristics and application requirements so legitimate users are less likely to be affected. DNS forwarding resolves or forwards DNS requests, certificate enrollment supports certificate management, and static routing controls packet forwarding paths. These functions do not directly regulate application request frequency. Rate limiting is therefore the appropriate capability for controlling excessive automated request activity.

Question 349. Which FortiWeb feature can protect against attempts to manipulate cookies used by a web application?

1. Web cache
2. Cookie security
3. Server load balancing
4. IP forwarding

Correct Answer: 2. Cookie security

Explanation :-

Cookie security provides controls for protecting cookies used by web applications. Cookies can contain information related to user sessions, authentication, or application state, making them an important security consideration. FortiWeb can apply cookie-related protections to help prevent unauthorized manipulation or misuse of cookie information. Web caching is intended to improve content delivery, server load balancing distributes application traffic across backend servers, and IP forwarding concerns packet forwarding rather than cookie protection. When an administrator needs to strengthen the security of application cookies, the appropriate FortiWeb capability is cookie security. Its configuration should be aligned with the application’s legitimate cookie behavior to avoid disrupting valid sessions.

Question 350. An administrator wants FortiWeb to distribute client requests across several backend web servers. Which feature should be configured?

1. Server load balancing
2. IP reputation
3. SQL injection detection
4. URL access control

Correct Answer: 1. Server load balancing

Explanation :-

Server load balancing distributes incoming application requests across multiple backend servers according to the configured balancing method and server availability. This can improve application scalability and availability by preventing a single backend server from handling all incoming traffic. FortiWeb can monitor backend servers and use configured policies to determine where permitted requests should be forwarded. IP reputation evaluates source addresses, SQL injection detection identifies malicious application input, and URL access control determines whether requested resources are permitted. These security functions do not primarily distribute traffic between backend systems. Server load balancing is therefore the appropriate feature for distributing client requests across multiple web servers.

Question 351. Which HTTP method is commonly associated with retrieving a resource without modifying it on the server?

1. DELETE
2. POST
3. GET
4. PATCH

Correct Answer: 3. GET

Explanation :-

The HTTP GET method is generally used to request or retrieve a resource from a server without intending to modify the resource. Web applications commonly use GET requests when clients request pages, images, documents, or API resources. POST is typically used to submit data for processing or create a resource, DELETE requests removal of a resource, and PATCH is commonly used for partial modification. Understanding HTTP methods is important when configuring FortiWeb policies because administrators may need to control which methods are permitted for particular URLs or applications. Restricting unnecessary methods can reduce the application’s exposed attack surface while preserving required functionality.

Question 352. Which FortiWeb feature can enforce restrictions on which HTTP methods are permitted for a protected application?

1. HTTP method enforcement
2. DNS caching
3. Server certificate generation
4. Static NAT

Correct Answer: 1. HTTP method enforcement

Explanation :-

HTTP method enforcement allows administrators to control which HTTP methods can be used when accessing protected web applications. An application may only require a limited set of methods, and blocking unnecessary methods can reduce opportunities for misuse. For example, an application that only requires GET and POST may not need methods such as DELETE or TRACE. FortiWeb can apply appropriate restrictions according to the application’s requirements. DNS caching and server certificate generation serve different purposes, while static NAT concerns address translation. HTTP method enforcement therefore provides a direct mechanism for controlling the HTTP operations that clients can perform against protected applications.

Question 353. What is the main purpose of URL access control in FortiWeb?

1. To determine which requested URLs clients are permitted to access
2. To encrypt all database connections
3. To assign IP addresses to clients
4. To synchronize system clocks

Correct Answer: 1. To determine which requested URLs clients are permitted to access

Explanation :-

URL access control allows FortiWeb administrators to define rules governing access to specific URLs or application resources. This can be useful when certain paths should only be available to authorized users, specific clients, or particular traffic conditions. By controlling access at the URL level, administrators can restrict exposure of sensitive or unnecessary application resources. Database encryption, IP address assignment, and time synchronization are unrelated functions. URL access control should be designed according to the application’s legitimate URL structure and access requirements. Proper configuration can help prevent unauthorized requests from reaching sensitive application areas while allowing normal access to publicly available resources.

Question 354. Which FortiWeb feature can detect and block malicious input designed to execute operating-system commands through a vulnerable web application?

1. Web cache
2. Command injection protection
3. SSL certificate renewal
4. Load balancing

Correct Answer: 2. Command injection protection

Explanation :-

Command injection protection is designed to identify malicious input intended to cause a vulnerable application to execute unauthorized operating-system commands. Such attacks can occur when an application passes untrusted user input to system commands without adequate validation or sanitization. FortiWeb can use application-layer security controls and signatures to detect patterns associated with command injection and take the configured protective action. Web caching improves content delivery, certificate renewal manages cryptographic credentials, and load balancing distributes traffic across backend systems. Command injection protection therefore addresses the specific threat described and is an important control for applications that process user-supplied input.

Question 355. An administrator wants FortiWeb to log security events for analysis without immediately blocking matching requests. Which action is most appropriate?

1. Block
2. Redirect
3. Alert or monitor
4. Reset connection

Correct Answer: 3. Alert or monitor

Explanation :-

An alert or monitor-oriented action allows administrators to observe matching traffic and record relevant security events without immediately enforcing a blocking response. This approach can be useful during policy deployment, troubleshooting, or tuning, especially when administrators need to understand normal application behavior before enabling stricter enforcement. Blocking would prevent the request, while redirecting changes the request’s destination and resetting the connection terminates the session. Monitoring should still be combined with appropriate logging and analysis so administrators can determine whether detected activity represents legitimate traffic or an actual threat. Once the policy has been validated, administrators can adjust the action if stronger enforcement is required.

Question 356. Which FortiWeb capability can help protect a web application by validating whether submitted parameters conform to expected formats and values?

1. Parameter validation
2. DNS forwarding
3. Traffic mirroring
4. Hardware inventory

Correct Answer: 1. Parameter validation

Explanation :-

Parameter validation helps ensure that application parameters contain values consistent with expected formats, types, or ranges. This can reduce the opportunity for attackers to submit unexpected or malicious input through application fields and URL parameters. Effective validation is particularly useful for applications with predictable parameter structures, such as numeric identifiers or predefined values. DNS forwarding and hardware inventory are unrelated to application input validation, while traffic mirroring duplicates traffic for monitoring purposes. Parameter validation should be designed carefully so legitimate application requests continue to work while malformed or suspicious values are rejected or handled according to the configured policy.

Question 357. Which FortiWeb mechanism can use previously observed application behavior to help establish a baseline for legitimate traffic?

1. Machine learning-based anomaly detection
2. Static DNS entries
3. Interface renaming
4. Manual routing

Correct Answer: 1. Machine learning-based anomaly detection

Explanation :-

Machine learning-based anomaly detection can analyze observed application behavior and establish patterns associated with normal traffic. Once a baseline has been developed, deviations from expected behavior can be identified for further investigation or enforcement, depending on the configuration. This approach can complement signature-based security because it does not rely exclusively on previously defined attack patterns. Static DNS entries, interface renaming, and manual routing do not perform behavioral analysis of application traffic. Administrators should understand the application’s normal behavior and tune detection appropriately because legitimate changes in traffic patterns can otherwise produce alerts. Behavioral analysis is particularly useful for identifying unusual activity that may not match a known signature.

Question 358. Which FortiWeb feature is specifically intended to protect against cross-site scripting attacks?

1. XSS protection
2. Server load balancing
3. DNS resolution
4. SSL certificate storage

Correct Answer: 1. XSS protection

Explanation :-

Cross-site scripting, or XSS, occurs when attackers cause malicious script content to be processed in a victim’s browser through a vulnerable web application. XSS protection in FortiWeb helps identify requests or content patterns associated with this type of attack and can apply the configured security action. Depending on the policy, suspicious traffic may be logged, alerted on, or blocked. Server load balancing distributes traffic, DNS resolution handles name-to-address mapping, and certificate storage supports cryptographic credentials. XSS protection therefore directly addresses the web application threat described. Proper configuration should consider the application’s legitimate input and output behavior to reduce unnecessary false positives.

Question 359. What is the purpose of a web application firewall signature in FortiWeb?

1. To identify known patterns associated with application-layer attacks
2. To allocate VLAN IDs
3. To configure administrator accounts
4. To synchronize firmware files

Correct Answer: 1. To identify known patterns associated with application-layer attacks

Explanation :-

Web application firewall signatures contain patterns or rules used to identify traffic associated with known application-layer attacks. FortiWeb can inspect HTTP or HTTPS application traffic and compare relevant content against configured signatures. When a match occurs, the associated policy action determines how the event is handled. This approach can help detect threats such as SQL injection, cross-site scripting, and other recognized attack techniques. VLAN allocation, administrator account configuration, and firmware synchronization serve different administrative or networking purposes. Signature-based inspection is therefore a fundamental FortiWeb security mechanism for detecting known malicious application traffic and enforcing the response defined by the administrator.

Question 360. An administrator needs to ensure that FortiWeb forwards requests only to healthy backend servers. Which capability should be configured?

1. Health checks
2. URL encoding
3. Cookie signing
4. IP reputation

Correct Answer: 1. Health checks

Explanation :-

Health checks allow FortiWeb to monitor the availability or responsiveness of backend servers and determine whether they are suitable destinations for application traffic. When a backend server fails the configured health check, FortiWeb can avoid sending new requests to that server, depending on the deployment and load-balancing configuration. This helps improve application availability and prevents traffic from being unnecessarily directed toward unavailable systems. URL encoding changes how URLs represent characters, cookie signing protects cookie integrity, and IP reputation evaluates source addresses. Health checks therefore provide the mechanism needed to identify backend server availability and support reliable traffic distribution.