View Full Fortinet NSE5_FWB_AD-8.0 Exam Dumps and Practice Test Dumps

 

Question 121. A FortiWeb administrator wants to protect a public web application by placing FortiWeb between Internet clients and the application’s origin servers. Which deployment mode provides this reverse-proxy functionality?

1. Transparent bridge inspection
2. Reverse proxy
3. Standalone vulnerability scanning
4. Client-side browser filtering

Correct Answer: 2. Reverse proxy

Explanation :-

In a reverse-proxy deployment, FortiWeb receives client requests on behalf of the protected application and then forwards permitted requests to backend servers. This positioning allows FortiWeb to inspect application traffic and apply controls such as WAF policies, access restrictions, authentication, bot mitigation, rate limiting, and other security mechanisms before traffic reaches the origin servers. It can also terminate client TLS connections and establish a separate connection to the backend. Vulnerability scanning is an assessment function rather than the primary traffic-processing deployment. Administrators should ensure that DNS, virtual server, server policy, and backend server settings are aligned with the reverse-proxy design.

Question 122. A web application accepts user input that is incorporated into database queries. The administrator wants to detect malicious SQL syntax before requests reach the application. Which FortiWeb protection is most appropriate?

1. SQL injection protection
2. HTTP caching
3. Server health checking
4. Cookie persistence

Correct Answer: 1. SQL injection protection

Explanation :-

SQL injection protection is designed to detect requests containing patterns associated with attempts to manipulate database queries through application input. Attackers may place malicious SQL syntax in URL parameters, form fields, cookies, or other request components. FortiWeb WAF inspection can identify such activity and apply the configured action, such as blocking or logging. HTTP caching does not analyze database-oriented attack patterns, health checks evaluate backend availability, and cookie persistence concerns session behavior. Administrators should review application-specific requirements because legitimate input can sometimes contain characters that resemble attack patterns. Security events should be monitored to identify false positives and tune protection appropriately.

Question 123. A company has multiple backend web servers and wants clients to remain associated with the same backend during an application session. Which feature should the administrator configure?

1. Web vulnerability scanning
2. Session persistence
3. Geographic access control
4. HTTP method filtering

Correct Answer: 2. Session persistence

Explanation :-

Session persistence helps maintain affinity between a client and a backend server when traffic is distributed across multiple servers. This is useful for applications where session information is stored locally on a particular backend instead of being shared across all servers. Without persistence, successive requests may be distributed to different servers and the application may lose session context. Web vulnerability scanning identifies application weaknesses, geographic access control restricts traffic according to location, and HTTP method filtering controls permitted request methods. Administrators should select persistence behavior that matches how the application identifies sessions and should verify that persistence does not interfere with normal load distribution or failover behavior.

Question 124. An administrator wants FortiWeb to reject requests containing an HTTP method that is not required by the protected application. Which configuration should be reviewed?

1. Server health-check interval
2. HTTP method restriction
3. Backend TLS certificate
4. HTTP response cache

Correct Answer: 2. HTTP method restriction

Explanation :-

HTTP method restriction allows FortiWeb to control which methods clients may use when accessing an application. Restricting unnecessary methods can reduce the application’s attack surface and prevent unsupported operations from reaching backend servers. For example, an application that only requires GET and POST may reject methods such as TRACE, DELETE, or CONNECT when they are not part of the application’s intended workflow. Health checks determine backend availability, certificates support secure connections, and response caching manages previously generated responses. Administrators should document the application’s required methods before enforcing the policy and review logs after deployment to confirm that legitimate requests are not being blocked.

Question 125. A FortiWeb administrator needs to distribute traffic among backend servers while avoiding servers that are currently unavailable. Which configuration should be verified?

1. Server pool and health-check configuration
2. URL rewriting rules only
3. Web vulnerability scanner only
4. Browser cookie settings only

Correct Answer: 1. Server pool and health-check configuration

Explanation :-

The server pool defines the backend members available to receive application traffic, while health checks allow FortiWeb to determine whether those members are responding as expected. Together, these settings support reliable traffic distribution and can prevent requests from being sent to backend servers that have failed their health checks. URL rewriting changes request URLs rather than determining backend availability. Vulnerability scanning evaluates application weaknesses, and browser cookie settings do not establish backend server health. When troubleshooting load-balancing problems, administrators should inspect pool membership, health-check type, intervals, expected responses, and the connectivity between FortiWeb and each backend server.

Question 126. A security team wants to stop malicious JavaScript from being submitted through an application’s form fields. Which threat should FortiWeb primarily inspect for?

1. Cross-site scripting
2. SQL injection
3. Server pool failure
4. TLS certificate expiration

Correct Answer: 1. Cross-site scripting

Explanation :-

Cross-site scripting, or XSS, involves malicious script content being introduced into application data and subsequently interpreted by a user’s browser. Attackers may attempt to submit such content through form fields, URL parameters, comments, or other user-controlled inputs. FortiWeb WAF protections can inspect requests for patterns associated with XSS and enforce the configured security action. SQL injection instead targets database query manipulation. Server pool failures concern backend availability, while certificate expiration affects TLS connections. Administrators should investigate XSS events and confirm whether the detected request is malicious or legitimate input. Application-level output encoding and input validation should also be used as part of a broader defense strategy.

Question 127. A FortiWeb administrator wants to prevent a public application from accepting traffic from a specific set of source IP addresses known to be malicious. Which control is most directly applicable?

1. HTTP caching
2. IP-based access control
3. Server health checks
4. API discovery

Correct Answer: 2. IP-based access control

Explanation :-

IP-based access control can permit or deny traffic according to source IP addresses. It can therefore be used to block known unwanted addresses before requests are allowed to proceed to the protected application. Administrators should maintain accurate address lists and understand whether the traffic source may be represented by proxies, NAT devices, or other intermediary systems. HTTP caching manages application responses, health checks monitor backend availability, and API discovery provides visibility into API endpoints. IP restrictions are most effective when combined with other security controls because source addresses can change and attackers may use distributed infrastructure. Logging denied requests can help verify that the rule is operating as intended.

Question 128. A company wants to enforce HTTPS for an application while allowing FortiWeb to inspect the decrypted request before forwarding it to a backend server. Which architecture is appropriate?

1. Client TLS termination on FortiWeb followed by application inspection
2. Disable TLS on the client connection
3. Forward encrypted traffic without any proxy processing
4. Use only DNS-based filtering

Correct Answer: 1. Client TLS termination on FortiWeb followed by application inspection

Explanation :-

When FortiWeb terminates the client’s TLS connection, it can decrypt the HTTP request and inspect it using its configured application security controls. This allows WAF policies and other protections to analyze the request before FortiWeb forwards it to the backend. The backend connection can remain encrypted as well if HTTPS is configured between FortiWeb and the origin server. Simply forwarding encrypted traffic without proxy processing would prevent the relevant application-layer inspection from occurring at FortiWeb. Disabling TLS would reduce transport security, while DNS filtering operates at a different layer. Administrators must configure appropriate certificates and TLS settings for the client-facing virtual server.

Question 129. An application has a sensitive administrative URL that should be accessible only from the organization’s internal network. Which combination provides a targeted control?

1. HTTP caching and compression
2. URL access control and source IP restriction
3. Server health checks and load balancing
4. Vulnerability scanning and API discovery

Correct Answer: 2. URL access control and source IP restriction

Explanation :-

URL access control can identify the sensitive administrative path, while source IP restrictions can limit access to approved internal networks. Combining these controls provides a targeted method of protecting a specific resource without necessarily restricting access to the entire application. Health checks and load balancing address backend availability and traffic distribution, while vulnerability scanning and API discovery provide assessment and visibility functions. Caching and compression do not provide authorization. Administrators should verify internal network ranges carefully and consider legitimate remote administration requirements. Logging denied requests can also help identify unexpected attempts to reach the protected administrative resource.

Question 130. A FortiWeb administrator receives reports that a legitimate API request is being blocked. The administrator wants to determine whether a WAF rule is responsible. What should be reviewed first?

1. The matched security event and associated rule details
2. The backend server’s desktop wallpaper
3. The browser’s saved bookmarks
4. The application’s DNS TTL only

Correct Answer: 1. The matched security event and associated rule details

Explanation :-

Security event details are the most useful starting point when investigating a FortiWeb block. They can reveal which protection mechanism or rule matched the request and what enforcement action was taken. The administrator can then compare the event information with the application’s expected API behavior and determine whether the request represents a true attack or a false positive. Browser bookmarks and unrelated backend settings do not identify the FortiWeb rule responsible for the block. DNS information may help with connectivity troubleshooting but does not normally explain why an already received request was rejected by a WAF rule. Evidence-based tuning should be performed only after identifying the exact trigger.

Question 131. An organization wants to discover APIs exposed by a web application and then apply security controls to those APIs. Which FortiWeb capabilities work together for this purpose?

1. API discovery and API protection
2. HTTP caching and URL rewriting
3. Server health checking and load balancing
4. Cookie security and certificate renewal

Correct Answer: 1. API discovery and API protection

Explanation :-

API discovery provides visibility into APIs observed in the application environment, while API protection allows administrators to apply security controls to API traffic. Together, these capabilities help organizations understand their API exposure and protect endpoints against unexpected or malicious requests. Discovery can be especially valuable when undocumented APIs have been introduced over time. HTTP caching and URL rewriting serve application-delivery purposes, while health checks and load balancing manage backend availability and distribution. Cookie security and certificate renewal address different security areas. Administrators should validate discovered API behavior and establish appropriate policies before enforcing restrictive controls that could disrupt legitimate integrations.

Question 132. A web application allows customers to upload documents. The security team wants to detect malware in uploaded files before they are delivered to the backend application. Which capability should be enabled?

1. HTTP method restriction
2. Antivirus scanning
3. Session persistence
4. URL rewriting

Correct Answer: 2. Antivirus scanning

Explanation :-

Antivirus scanning allows FortiWeb to inspect uploaded content for known malicious files before the content is passed to the protected application, depending on the configured inspection capabilities and policy. This is useful for applications that accept documents or other user-supplied files. HTTP method restrictions control which request methods are permitted, session persistence controls backend affinity, and URL rewriting changes URL behavior. Administrators should consider file size limits, supported formats, inspection performance, and legitimate upload requirements when enabling file inspection. File scanning should complement secure backend handling because detecting known malware does not eliminate all risks associated with storing, processing, or serving user-uploaded content.

Question 133. A FortiWeb deployment must continue serving a web application if one FortiWeb appliance becomes unavailable. Which design should the administrator investigate?

1. High availability
2. HTTP caching
3. URL access control
4. API discovery

Correct Answer: 1. High availability

Explanation :-

High availability allows multiple FortiWeb appliances to work together so that service can continue if one appliance becomes unavailable, according to the configured HA design and failover behavior. This improves resilience by reducing dependence on a single security appliance. HTTP caching stores responses, URL access control governs application paths, and API discovery provides visibility into APIs; none of these functions provides appliance-level redundancy. Administrators implementing HA should verify synchronization, interface configuration, heartbeat connectivity, failover conditions, and the expected traffic path. They should also test failover in a controlled manner to confirm that protected applications remain accessible when the active appliance experiences a failure.

Question 134. An administrator wants to reduce the risk of a web application being overwhelmed by excessive connection or request activity. Which FortiWeb feature should be investigated?

1. DoS protection
2. Certificate import
3. HTTP response caching only
4. URL rewriting

Correct Answer: 1. DoS protection

Explanation :-

DoS protection is designed to help mitigate traffic patterns that may exhaust application or network resources. FortiWeb can use configured thresholds and detection mechanisms to identify abnormal or excessive activity and apply the relevant mitigation action. This is different from normal load balancing, which distributes traffic but does not necessarily identify malicious request patterns. Certificate import manages TLS credentials, URL rewriting modifies request paths, and caching can reduce backend processing for eligible responses. Administrators should establish thresholds based on normal application behavior and monitor security events after deployment. Overly aggressive thresholds can affect legitimate traffic during expected usage spikes, so tuning should be evidence-based.

Question 135. A FortiWeb administrator wants to improve visibility into which security rules are blocking application requests. Which logging information is most useful?

1. Security event and traffic log details
2. Browser history only
3. Server rack temperature only
4. DNS cache entries only

Correct Answer: 1. Security event and traffic log details

Explanation :-

Security event and traffic logs provide information about requests processed by FortiWeb and can help identify which security controls or policies affected those requests. Depending on the configuration, logs may contain information about the source, destination, URL, action, matched rule, and other relevant details. This information is useful when investigating false positives, blocked traffic, or unexpected application behavior. Browser history and DNS cache entries may assist with client-side troubleshooting but do not identify FortiWeb enforcement decisions. Physical server information is unrelated to policy matching. Administrators should configure appropriate logging levels and retain sufficient event detail for troubleshooting and security investigations.

Question 136. An application should allow only approved HTTP methods and reject all others. Which FortiWeb feature provides this enforcement?

1. Web vulnerability scanning
2. HTTP method restriction
3. Server pool health checks
4. Antivirus scanning

Correct Answer: 2. HTTP method restriction

Explanation :-

HTTP method restriction allows administrators to define which HTTP methods are permitted for a protected application. Requests using methods outside the approved list can be rejected before they reach the backend server. This provides a straightforward way to reduce the application’s attack surface when certain methods are unnecessary. Vulnerability scanning identifies weaknesses rather than controlling runtime requests. Health checks monitor backend availability, while antivirus scanning focuses on malicious file content. Administrators should verify all application and API workflows before applying restrictions because some modern applications may use methods beyond GET and POST. Logging rejected methods can help identify unexpected legitimate dependencies after deployment.

Question 137. A security team wants to protect an application from automated clients that perform credential attacks against a login page. Which FortiWeb functionality should be considered?

1. Bot management and mitigation
2. HTTP caching
3. Server certificate renewal
4. Backend health checking

Correct Answer: 1. Bot management and mitigation

Explanation :-

Bot management and mitigation can help identify and control automated clients that interact with web applications. Credential attacks often involve automated attempts to submit large numbers of login requests, making bot-related controls useful alongside other protections such as rate limiting and authentication controls. HTTP caching does not distinguish automated users, certificate renewal manages TLS credentials, and health checks evaluate backend availability. Administrators should identify legitimate automated clients, such as approved integrations and monitoring systems, before applying aggressive blocking. Combining bot detection with request-rate controls and appropriate authentication protections can provide broader coverage against automated abuse while minimizing disruption to legitimate application traffic.

Question 138. A company wants to prevent clients from accessing its web application from selected geographic regions. Which FortiWeb function is most directly related to this requirement?

1. HTTP response caching
2. Geographic IP access control
3. Backend session persistence
4. API schema discovery

Correct Answer: 2. Geographic IP access control

Explanation :-

Geographic IP access control can use IP geolocation information to permit or deny traffic based on countries or regions. This can be useful when an application has geographic access requirements or when an organization wants to reduce exposure from locations outside its expected user base. Geolocation is not a replacement for authentication or other security controls because IP-based location data can have limitations and users may connect through proxies or VPN services. HTTP caching controls responses, session persistence maintains backend affinity, and API discovery identifies API endpoints. Administrators should validate business requirements and monitor the results before applying geographic restrictions broadly.

Question 139. A FortiWeb administrator wants to inspect HTTPS traffic and then maintain encryption between FortiWeb and an HTTPS backend server. Which configuration supports this requirement?

1. Client-side TLS termination with backend HTTPS re-encryption
2. HTTP-only communication to the backend
3. DNS forwarding without TLS
4. Client-side caching only

Correct Answer: 1. Client-side TLS termination with backend HTTPS re-encryption

Explanation :-

FortiWeb can terminate the client-side TLS session, decrypt the request for security inspection, and then establish a separate HTTPS session with the backend server. This architecture provides encrypted communication on both sides of FortiWeb while still allowing application-layer inspection. The backend TLS connection requires appropriate certificate and trust configuration. Using HTTP between FortiWeb and the backend would leave that segment unencrypted, while DNS forwarding and caching do not provide the required application-layer encryption. Administrators should verify both client-facing and backend-facing TLS settings, including certificates, supported protocols, cipher configuration, and trust requirements.

Question 140. A FortiWeb administrator is investigating why a request reaches FortiWeb but does not appear to use the expected server policy. Which areas should be checked first?

1. Only the backend server’s disk capacity
2. Virtual server, Host header, policy matching, and related logs
3. Only the client’s browser cache
4. Only the application’s database indexes

Correct Answer: 2. Virtual server, Host header, policy matching, and related logs

Explanation :-

When a request reaches FortiWeb but appears to bypass the expected server policy, the administrator should first verify how the request is being matched. The virtual server configuration, destination information, HTTP Host header, policy association, and relevant logs can reveal why a different policy or virtual server handled the request. Backend disk capacity and database indexes may affect application performance but do not normally determine FortiWeb policy selection. Browser cache can influence client behavior but does not explain FortiWeb’s policy-matching decision by itself. A systematic review of request attributes and matching conditions helps identify configuration conflicts without unnecessarily changing unrelated security or backend settings.