View Full Fortinet NSE5_FWB_AD-8.0 Exam Dumps and Practice Test Dumps

 

Question 61. A FortiWeb administrator wants to protect an application from attackers who attempt to manipulate database queries through HTTP parameters. Which protection is most relevant?

1. HTTP caching
2. SQL injection protection
3. Server health checking
4. DNS forwarding

Correct Answer: 2. SQL injection protection

Explanation :-

SQL injection protection is designed to identify malicious input that attempts to alter database queries through application parameters or other request components. FortiWeb can use web application firewall capabilities to inspect requests and detect patterns associated with SQL injection. This protection should be tuned according to the application’s legitimate input requirements to reduce false positives. HTTP caching and server health checking address application delivery and backend availability, while DNS forwarding provides name resolution. SQL injection protection is one part of a broader defense strategy that should also include secure coding, parameterized database queries, input validation, and appropriate database privileges.

Question 62. A web application uses a large number of dynamically generated pages. The administrator wants to distribute traffic across several backend servers without unnecessarily forcing every client to the same server. Which FortiWeb capability should be configured?

1. Load balancing
2. API discovery
3. URL rewriting
4. Vulnerability scanning

Correct Answer: 1. Load balancing

Explanation :-

Load balancing distributes incoming application traffic among available backend servers. FortiWeb can use configured server pools and load-balancing methods to determine how requests are distributed. This can improve resource utilization and application availability while reducing the likelihood that a single backend server becomes overloaded. API discovery identifies application interfaces, URL rewriting modifies request handling, and vulnerability scanning assesses application weaknesses. The administrator should select a load-balancing method appropriate to the application’s behavior and should also configure suitable health checks so that unavailable backend servers are not unnecessarily selected for new requests.

Question 63. A security team wants FortiWeb to reject requests containing file names or parameters that match known malicious patterns. Which FortiWeb capability is most directly involved?

1. DNS configuration
2. Web application firewall signatures
3. HTTP caching
4. Server load balancing

Correct Answer: 2. Web application firewall signatures

Explanation :-

Web application firewall signatures provide pattern-based detection for recognized application attacks and malicious request characteristics. FortiWeb can inspect HTTP traffic and compare relevant portions of requests against configured signatures to identify threats. Depending on the configured action, matching traffic can be blocked, logged, or otherwise handled. DNS configuration manages name resolution, HTTP caching improves delivery efficiency, and server load balancing distributes requests among backend servers. Signature-based protection is particularly useful for known attack patterns, although administrators should combine it with other controls such as input validation, behavioral protection, and appropriate application-specific policies.

Question 64. An administrator needs to protect a web application hosted on several servers while ensuring that FortiWeb can detect when one backend server becomes unavailable. Which combination is most appropriate?

1. URL rewriting and HTTP caching
2. API discovery and vulnerability scanning
3. Server pool and health checks
4. DNS forwarding and NTP

Correct Answer: 3. Server pool and health checks

Explanation :-

A server pool identifies the backend servers that can receive application traffic, while health checks allow FortiWeb to evaluate their availability. Together, these capabilities support reliable application delivery. When a backend server fails its configured health check, FortiWeb can recognize that condition and adjust traffic distribution according to the configured load-balancing behavior. URL rewriting, caching, API discovery, and vulnerability scanning address different application requirements. DNS and NTP provide supporting network services but do not replace backend health monitoring. Correct server-pool and health-check configuration is therefore important when protecting applications with multiple backend instances.

Question 65. A company wants to reduce automated scraping of product information from its public website. Which FortiWeb capability should the administrator investigate?

1. Bot management
2. DNS forwarding
3. HTTP caching
4. Server health checks

Correct Answer: 1. Bot management

Explanation :-

Bot management can help identify and control automated clients interacting with a web application. Automated scraping can consume resources and extract application data at a rate or pattern that differs from normal human browsing. FortiWeb bot-related controls can help administrators distinguish suspicious automation from legitimate clients and apply appropriate actions. DNS forwarding handles name resolution, HTTP caching focuses on application delivery, and server health checks monitor backend availability. Bot controls should be carefully tuned because some automated clients, such as search-engine crawlers or approved integrations, may be legitimate and should not necessarily be blocked.

Question 66. A FortiWeb administrator needs to protect an application whose clients connect over HTTPS, but the backend application server also requires HTTPS. What should the administrator configure?

1. HTTP-only communication
2. SSL/TLS termination with secure backend communication
3. DNS forwarding
4. HTTP caching without inspection

Correct Answer: 2. SSL/TLS termination with secure backend communication

Explanation :-

FortiWeb can terminate the client-side TLS connection so that encrypted application traffic can be inspected by its security controls. If the backend server also requires encrypted communication, FortiWeb can establish an appropriate secure connection toward the backend. This architecture allows inspection while maintaining encryption on both network segments. HTTP-only communication would remove encryption, while DNS forwarding and caching do not provide TLS inspection. Correct certificate and private-key configuration is required on the client-facing side, and the administrator must also configure the appropriate trust and certificate settings for communication with the backend server.

Question 67. A security administrator wants to restrict access to an application according to the source IP address of incoming clients. Which FortiWeb function should be considered?

1. HTTP caching
2. Server health checking
3. IP-based access control
4. API discovery

Correct Answer: 3. IP-based access control

Explanation :-

IP-based access control allows administrators to permit or restrict requests based on source IP addresses or address-related criteria. This can be useful when an application should be accessible only from known networks, partners, or administrative locations. Administrators should carefully define the permitted sources and consider how proxies, NAT, cloud services, and other intermediaries affect the source address visible to FortiWeb. HTTP caching and server health checks serve application-delivery functions, while API discovery provides visibility into APIs. IP-based controls should normally be combined with authentication and other security controls rather than being treated as the sole protection mechanism.

Question 68. A web application accepts uploaded files. The security team wants FortiWeb to inspect uploaded content for malicious files. Which capability is most relevant?

1. Antivirus scanning
2. DNS forwarding
3. URL rewriting
4. Server health monitoring

Correct Answer: 1. Antivirus scanning

Explanation :-

Antivirus scanning can provide an additional security layer for content transferred through web applications, including applicable uploaded files. Inspecting uploads can help identify malicious content before it reaches the backend application or other systems. The exact files and protocols that can be inspected depend on the FortiWeb deployment and configured security features. DNS forwarding handles name resolution, URL rewriting modifies request processing, and server health monitoring evaluates backend availability. Administrators should also enforce appropriate file-type restrictions, size limits, application validation, and secure storage practices because antivirus inspection should complement rather than replace secure file-upload design.

Question 69. A FortiWeb administrator wants to limit the number of requests a client can send to a sensitive application endpoint within a defined period. Which security mechanism is most appropriate?

1. URL rewriting
2. Rate limiting
3. API discovery
4. HTTP caching

Correct Answer: 2. Rate limiting

Explanation :-

Rate limiting can restrict the frequency or volume of requests allowed from clients to protected application resources. This can help reduce abuse of sensitive endpoints such as login, search, transaction, or API operations. Appropriate thresholds should be based on legitimate application behavior because an excessively restrictive limit can affect normal users. URL rewriting changes request paths, API discovery identifies application interfaces, and caching reduces repeated backend requests for eligible content. Rate limiting can complement authentication, bot mitigation, and DoS protection by controlling excessive request activity without necessarily blocking all traffic from a source.

Question 70. A company wants to protect an application against requests containing malicious command sequences intended to execute operating-system commands. Which FortiWeb protection should be enabled?

1. HTTP caching
2. Server load balancing
3. Command injection protection
4. DNS forwarding

Correct Answer: 3. Command injection protection

Explanation :-

Command injection protection addresses attempts to insert operating-system commands into application input. Such attacks can occur when applications pass user-controlled data to system commands without adequate validation or safe handling. FortiWeb WAF capabilities can inspect application traffic for patterns associated with command injection and take configured actions. HTTP caching, load balancing, and DNS forwarding do not directly detect this application-layer threat. Protection should be combined with secure application development practices, input validation, least-privilege execution, and safe system-call mechanisms because preventing command injection at the application level remains the strongest defense.

Question 71. A security administrator needs to identify which URLs within a protected application are generating the highest number of requests. Which information source should be reviewed?

1. Traffic and application logs
2. NTP configuration
3. SSL certificate expiration only
4. DNS server settings

Correct Answer: 1. Traffic and application logs

Explanation :-

Traffic and application logs can provide visibility into requested URLs, source clients, request counts, actions, and other application traffic characteristics. Reviewing these logs can help administrators identify heavily accessed resources and investigate unusual request patterns. NTP configuration and DNS settings support infrastructure functions but do not normally provide detailed application request information. Certificate expiration information is important for HTTPS availability but does not identify URL request volumes. Administrators should configure sufficient logging and retention to support the level of analysis required while also considering storage capacity and privacy requirements associated with retaining application traffic information.

Question 72. A FortiWeb administrator wants to prevent an application from accepting HTTP requests that use methods not supported by the application. Which control should be configured?

1. HTTP method restriction
2. Server health check
3. HTTP cache
4. API discovery

Correct Answer: 1. HTTP method restriction

Explanation :-

HTTP method restriction allows administrators to define which HTTP methods are acceptable for a protected application. If an application only requires specific methods, rejecting unnecessary methods can reduce the attack surface and prevent unexpected request behavior. Before enforcing the restriction, administrators should document the methods used by legitimate application functions, including API operations and administrative workflows. Server health checks monitor backend availability, caching handles content delivery, and API discovery identifies application interfaces. Proper method restrictions can therefore provide an additional layer of application security when they accurately reflect the application’s legitimate HTTP behavior.

Question 73. A company wants to ensure that FortiWeb can identify the application requested when multiple websites use the same public IP address. Which HTTP information is commonly used for this purpose?

1. HTTP Host header
2. TCP window size
3. DNS cache timeout
4. NTP packet

Correct Answer: 1. HTTP Host header

Explanation :-

The HTTP Host header identifies the hostname requested by the client and is commonly used in virtual-host configurations where multiple websites share an IP address. FortiWeb can use virtual-host information as part of application traffic processing and policy matching, depending on the deployment. TCP window size relates to transport behavior, DNS cache timeout affects name-resolution caching, and NTP packets provide time synchronization. Correct virtual-host configuration is important when multiple domains are protected by the same FortiWeb appliance because each application may require a different backend destination, certificate, security profile, or traffic-handling policy.

Question 74. A security team wants to identify application-layer attacks that may not be adequately addressed by a simple IP-based firewall rule. Which FortiWeb capability provides this deeper inspection?

1. Static routing
2. Web Application Firewall
3. NTP synchronization
4. DNS forwarding

Correct Answer: 2. Web Application Firewall

Explanation :-

A Web Application Firewall examines application-layer requests and can detect threats that depend on HTTP structure, parameters, URLs, headers, cookies, and payload content. This provides protection beyond basic IP and network-layer filtering. FortiWeb WAF capabilities can address threats such as injection attacks, malicious input, and other application-layer attack patterns. Static routing determines packet paths, NTP synchronizes system time, and DNS forwarding resolves names. A WAF should complement network firewalls rather than replace them because application security and network security address different layers of the traffic path.

Question 75. A FortiWeb administrator is investigating a suspected false positive from a WAF rule. Which information is most useful when determining why the request was blocked?

1. The appliance serial number
2. The administrator’s browser version
3. The security event details and matched rule
4. The NTP server hostname

Correct Answer: 3. The security event details and matched rule

Explanation :-

Security event details and matched-rule information can reveal which WAF control identified the request and what characteristics triggered the security action. This allows the administrator to determine whether the request is genuinely malicious or whether the application requires a more precise security configuration. Reviewing the matched rule, request details, policy context, and configured action is more useful than examining unrelated system information. If a legitimate request is incorrectly blocked, administrators should prefer narrowly scoped tuning or exceptions rather than disabling broad security protections. Detailed event information therefore plays an important role in effective WAF troubleshooting.

Question 76. An organization wants to identify vulnerabilities in its web application by actively testing application behavior. Which FortiWeb feature is designed for this purpose?

1. Web vulnerability scanner
2. Server load balancing
3. HTTP caching
4. Bot management

Correct Answer: 1. Web vulnerability scanner

Explanation :-

A web vulnerability scanner actively evaluates web applications for security weaknesses and known vulnerability conditions. It can provide security teams with information about areas that may require remediation before or during application deployment. Scanning is different from runtime WAF protection: a WAF primarily controls live application traffic, whereas vulnerability scanning is intended to discover weaknesses. Server load balancing distributes traffic, caching improves delivery performance, and bot management controls automated clients. Scanning should be performed with appropriate authorization and testing safeguards because active security testing can generate unusual requests or affect applications that are not designed to handle them.

Question 77. A web application is experiencing a sudden increase in requests that threatens to exhaust server resources. Which FortiWeb protection should be considered first?

1. API discovery
2. URL rewriting
3. DoS protection and rate controls
4. HTTP caching only

Correct Answer: 3. DoS protection and rate controls

Explanation :-

DoS protection and rate controls can help limit abnormal request volumes that threaten application or system availability. DoS controls can identify traffic patterns associated with resource exhaustion, while rate controls can restrict excessive request frequency according to configured thresholds. Administrators should consider the application’s normal traffic baseline before establishing limits so that legitimate traffic spikes are not unnecessarily blocked. API discovery and URL rewriting serve different purposes, while caching may reduce backend load for suitable content but does not by itself address all forms of request-based resource exhaustion. Availability protection should be combined with monitoring and appropriate upstream controls where necessary.

Question 78. A company wants to protect sensitive user sessions from being exposed through insecure application cookies. Which FortiWeb security area should be reviewed?

1. Cookie security
2. Server health checking
3. DNS forwarding
4. HTTP caching

Correct Answer: 1. Cookie security

Explanation :-

Cookie security is important for protecting session identifiers and other information stored in browser cookies. Administrators can review cookie-related security controls to help reduce risks associated with insecure cookie handling. Depending on the application and supported configuration, important considerations can include secure transmission, appropriate cookie attributes, and protection against manipulation or exposure. Server health checks monitor backend availability, DNS forwarding provides name resolution, and HTTP caching manages reusable content. Cookie controls should complement secure application development and HTTPS because application sessions can remain vulnerable if the underlying authentication and session-management design is insecure.

Question 79. A FortiWeb administrator wants to preserve application availability when one backend server becomes unavailable. Which configuration should be verified?

1. The DNS cache
2. The server pool and health-check configuration
3. The URL rewrite table only
4. The HTTP cache only

Correct Answer: 2. The server pool and health-check configuration

Explanation :-

The server pool defines the backend servers available to receive traffic, while health checks allow FortiWeb to determine whether those servers are operational. Correctly configuring both is important for application availability when multiple backend servers are used. If one server becomes unavailable, FortiWeb can use health-check results to avoid directing new traffic toward an unhealthy member, subject to the configured load-balancing behavior. DNS cache, URL rewriting, and HTTP caching do not directly provide backend failover. Administrators should also verify that enough healthy servers remain available to handle the expected application workload during a backend failure.

Question 80. A security administrator wants to review FortiWeb events from multiple security systems in a centralized platform for correlation and analysis. Which approach is most appropriate?

1. Disable local logging
2. Configure centralized log forwarding
3. Enable HTTP caching
4. Configure URL rewriting

Correct Answer: 2. Configure centralized log forwarding

Explanation :-

Centralized log forwarding allows FortiWeb events to be sent to an external logging or security-analysis platform where they can be correlated with events from other systems. Centralized analysis can improve visibility during investigations and help security teams identify patterns that may not be obvious when reviewing a single appliance. Local logging should generally remain appropriately configured because it can provide useful troubleshooting information. HTTP caching and URL rewriting perform application-delivery functions rather than event collection. Administrators should also consider log severity, retention, time synchronization, secure transport, and storage requirements when designing centralized logging.