I85PREP
⌘ K
FCP FortiWeb 7.4 study materials
FCP FortiWeb 7.4 study resources

FCP FortiWeb 7.4 practice questions

One question at a time. Build your FCP FortiWeb 7.4 understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1FortiWeb-style application protection, API controls and measured tuning

In the supplied FortiWeb 7.4 reverse-proxy design, clients address a FortiWeb virtual-server listener and FortiWeb opens connections to a back-end pool. Which listed mode matches that addressed front-end proxy arrangement?

  1. Offline Detection
  2. True Transparent Proxy
  3. Reverse Proxy Correct answer.
  4. Transparent Inspection

Explanation

Reverse Proxy fits the supplied addressed virtual-server front end and forwarding to back-end servers. Compare actual addressing, topology and supported features rather than claiming that every transparent mode never proxies TCP. The selected 7.4 documentation and configuration determine each mode’s behavior.

Question 2FortiWeb-style application protection, API controls and measured tuning

A FortiWeb administrator wants to deploy the appliance without changing the IP addressing of the protected web servers and still terminate SSL on FortiWeb. Which deployment mode should be selected?

  1. Reverse Proxy
  2. Transparent Inspection
  3. True Transparent Proxy Correct answer.
  4. Offline Detection

Explanation

True Transparent Proxy operates at Layer 2 (bridged) so the protected servers keep their original IP addresses, yet FortiWeb still terminates and re-initiates the TCP/SSL session, which allows SSL inspection, content rewriting, and full Layer 7 protection. Reverse Proxy requires changing public DNS or front-end IPs. Transparent Inspection cannot terminate SSL bidirectionally. Offline Detection is passive and cannot block in real time.

Question 3FortiWeb-style application protection, API controls and measured tuning

Which deployment mode uses a SPAN/mirror port and can only RST-block attacks rather than fully drop them?

  1. Reverse Proxy
  2. Offline Detection Correct answer.
  3. True Transparent Proxy
  4. WCCP

Explanation

Offline Detection (also called Offline Protection) attaches FortiWeb to a SPAN or network tap so it sees a copy of the traffic. Because it is not in line, it cannot drop packets; it can only send TCP RST packets to attempt to break offending sessions. It is typically used for evaluation, monitoring, or learning. The other modes are inline and can fully block traffic.

Question 4FortiWeb-style application protection, API controls and measured tuning

In WCCP deployment mode, which device is responsible for redirecting HTTP traffic to FortiWeb?

  1. The web client
  2. An upstream WCCP-capable router or switch Correct answer.
  3. The back-end web server
  4. A FortiAnalyzer collector

Explanation

WCCP (Web Cache Communication Protocol) deployment uses a WCCP-capable router or Layer 3 switch (typically a FortiGate or Cisco device) to redirect HTTP/HTTPS flows to FortiWeb based on a service group. FortiWeb registers with the WCCP server and processes the traffic, then returns it. The client and server are unaware of FortiWeb's presence.

Question 5FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb deployment mode is bridged at Layer 2 but only inspects traffic without re-initiating the TCP connection toward the server?

  1. Reverse Proxy
  2. True Transparent Proxy
  3. Transparent Inspection Correct answer.
  4. WCCP

Explanation

Transparent Inspection bridges traffic at Layer 2 and inspects it on the fly. Unlike True Transparent Proxy, it does not terminate and re-establish the TCP session, so some features that require connection ownership (full SSL offload, advanced rewriting, caching) are unavailable. It can still block by injecting RST packets or dropping packets in the bridge.

Question 6FortiWeb-style application protection, API controls and measured tuning

In Reverse Proxy mode, which FortiWeb interface receives client traffic?

  1. The interface bound to the Virtual Server Correct answer.
  2. The HA heartbeat interface
  3. The dedicated FortiSandbox interface
  4. The console serial port

Explanation

The Virtual Server is bound to a specific FortiWeb network interface and IP. Client traffic destined for that IP/port is processed and forwarded to the Server Pool out of another interface (or the same one in single-arm deployments). Heartbeat is for HA, not data plane.

Question 7FortiWeb-style application protection, API controls and measured tuning

What is the primary use of a FortiWeb V-zone (bridge) interface?

  1. Provide the Layer 2 forwarding plane needed for True Transparent Proxy or Transparent Inspection Correct answer.
  2. Manage SNMP
  3. Run the GUI
  4. Forward FortiSandbox uploads

Explanation

V-zones (virtual bridges) group two or more interfaces into a single Layer 2 domain so traffic can be bridged through FortiWeb in the transparent modes. The bridge has its own management IP for the VLAN/segment.

Question 8FortiWeb-style application protection, API controls and measured tuning

FortiWeb 7.4 supports which container packaging for cloud deployments?

  1. Docker container, plus VM images for AWS/Azure/GCP/OCI Correct answer.
  2. Only Hyper-V
  3. Only AWS AMI
  4. Only Docker

Explanation

FortiWeb is shipped as VM images for VMware, KVM, Hyper-V, AWS, Azure, GCP, and OCI, and as a Docker container for Kubernetes deployments. This lets customers deploy WAF as code alongside their applications, in addition to physical appliances.

Question 9FortiWeb-style application protection, API controls and measured tuning

FortiWeb Cloud is best described as:

  1. A SaaS-delivered WAF managed by Fortinet Correct answer.
  2. An on-prem-only appliance
  3. A FortiSandbox add-on
  4. A FortiClient package

Explanation

FortiWeb Cloud (SaaS WAF-as-a-Service) is operated by Fortinet and protects customer applications via DNS or BYO IP. Customers point traffic at FortiWeb Cloud and define applications and policies. It is a deployment alternative to running FortiWeb VMs or appliances.

Question 10FortiWeb-style application protection, API controls and measured tuning

To pass FortiWeb 7.4 inspection without inspecting SSL while still defending the back end, you can:

  1. Configure SSL pass-through with Layer 4 controls only - at the cost of losing Layer 7 protection Correct answer.
  2. Disable the WAF entirely
  3. Switch to FortiClient
  4. Replace with FortiSandbox

Explanation

SSL pass-through forwards encrypted traffic without decryption. Layer 4 controls (rate limit, ACL, Geo IP) can still apply, but signatures, ML, bot, parameter validation, and most other Layer 7 protections cannot inspect encrypted payloads. SSL inspection is required for full WAF coverage.

Question 11FortiWeb-style application protection, API controls and measured tuning

In the documented FortiWeb reverse-proxy object model, which listed object identifies the front-end IP address/interface used by the server policy, rather than the pool of back-end servers?

  1. Server Pool
  2. Virtual Server Correct answer.
  3. Server Policy
  4. Protected Hostnames

Explanation

A Virtual Server identifies the relevant front-end address/interface in this model. The actual server policy and associated service settings determine traffic handling and ports, while a server pool describes back-end members. Object roles should be checked against the selected version rather than merged into one universal listener definition.

Question 12FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb object is a logical grouping of physical or virtual back-end web servers used for load balancing?

  1. Server Pool Correct answer.
  2. Virtual Server
  3. Web Protection Profile
  4. Network Service

Explanation

A Server Pool is a list of one or more real web servers (with IPs, ports, weights, and health-check settings) that FortiWeb load-balances traffic to. The Server Policy attaches a Virtual Server (front end) to a Server Pool (back end) and applies inspection profiles. A Web Protection Profile is the inspection bundle, not the back-end target.

Question 13FortiWeb-style application protection, API controls and measured tuning

Which load-balancing algorithm in a FortiWeb Server Pool sends new connections to the server with the fewest active sessions?

  1. Round Robin
  2. Weighted Round Robin
  3. Least Connection Correct answer.
  4. Source IP Hash

Explanation

Least Connection forwards each new request to the back-end server currently handling the fewest active sessions, which helps balance long-running requests. Round Robin rotates regardless of load, Weighted Round Robin applies static weights, and Source IP Hash pins a client to a server for session persistence.

Question 14FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb feature ensures all requests from a single client continue to be routed to the same back-end server?

  1. HTTP redirect
  2. Session persistence Correct answer.
  3. Content routing
  4. HTTP/2 multiplexing

Explanation

Session persistence (also called sticky sessions) keeps a client bound to the same back-end server across multiple requests. FortiWeb supports persistence by source IP, cookie insertion, ASP.NET session ID, embedded cookies, and others. Content routing chooses a pool based on URL or header, but does not by itself maintain stickiness.

Question 15FortiWeb-style application protection, API controls and measured tuning

What does enabling SSL/TLS offload on a FortiWeb Server Policy allow the back-end servers to do?

  1. Receive plain HTTP traffic from FortiWeb Correct answer.
  2. Negotiate SSL directly with the client
  3. Disable web protection
  4. Bypass the WAF entirely

Explanation

With SSL/TLS offload, FortiWeb terminates the client TLS session, decrypts traffic, performs inspection, and forwards plaintext HTTP (or re-encrypted HTTPS) to the back-end servers. Offloading frees CPU on the back-end servers and centralizes certificate management. It does not disable the WAF - inspection still occurs on the decrypted traffic.

Question 16FortiWeb-style application protection, API controls and measured tuning

Which certificate is required on FortiWeb to perform SSL inspection of HTTPS traffic in Reverse Proxy mode?

  1. The client's personal certificate
  2. A copy of the server's certificate and private key Correct answer.
  3. An intermediate CA bundle only
  4. A FortiGuard signed certificate

Explanation

In Reverse Proxy mode FortiWeb impersonates the protected web server, so it must present that server's certificate to clients. To do this, the server's certificate and matching private key must be imported into FortiWeb. Intermediate CA bundles are needed only to complete the chain; the leaf certificate and key are mandatory.

Question 17FortiWeb-style application protection, API controls and measured tuning

In FortiWeb 7.4, which feature lets the WAF send a different X-Forwarded-For value or insert real client IP into the HTTP header sent to the back end?

  1. Content rewriting
  2. X-Forwarded-For (XFF) header insertion Correct answer.
  3. Session helper
  4. HTTP/2 push

Explanation

FortiWeb supports XFF and X-Real-IP header insertion in Server Policy or HTTP header rewriting to preserve the original client IP for back-end logging and application logic. Without it, back-end logs would show only the FortiWeb interface IP. Generic content rewriting can also accomplish this but XFF insertion is the dedicated control.

Question 18FortiWeb-style application protection, API controls and measured tuning

Which mode of single-arm Reverse Proxy avoids changing routing on the protected web server?

  1. Source NAT (Full NAT) on FortiWeb Correct answer.
  2. Direct Server Return only
  3. Bridged-only
  4. Layer 2 transparent

Explanation

In single-arm Reverse Proxy with Source NAT (Full NAT), FortiWeb replaces the client source IP with its own when forwarding to the back end, so the server's default gateway doesn't need to point at FortiWeb. The trade-off is that XFF must be enabled to preserve client IP for logs.

Question 19FortiWeb-style application protection, API controls and measured tuning

Which protocol does FortiWeb 7.4 support for automatic public certificate issuance and renewal?

  1. ACME (Let's Encrypt and other ACME-compliant CAs) Correct answer.
  2. SCEP only
  3. CMP
  4. TLS-PSK

Explanation

FortiWeb 7.4 includes an ACME client that can automatically request and renew certificates from Let's Encrypt or any ACME v2 CA. The certificate is bound to a Virtual Server and renewed before expiry. SCEP is used in different contexts (router/MDM enrollment).

Question 20FortiWeb-style application protection, API controls and measured tuning

FortiWeb's HTTP/2 support requires which combination on the front end?

  1. TLS 1.2 or higher with ALPN advertising h2 Correct answer.
  2. HTTP/1.0 with chunked encoding
  3. Plain TCP without TLS
  4. Only QUIC

Explanation

HTTP/2 over the public Internet is universally negotiated through TLS with ALPN extension advertising "h2". FortiWeb supports TLS 1.2/1.3 and ALPN h2 on Virtual Servers. The connection from FortiWeb to the back end can still be HTTP/1.1.

Question 21FortiWeb-style application protection, API controls and measured tuning

Which option ensures that when SSL inspection is enabled, even renegotiation handshakes are inspected?

  1. Inspect SSL renegotiation/secure renegotiation enabled Correct answer.
  2. DNS rebinding
  3. Geo IP
  4. XFF insertion

Explanation

Renegotiation can be used by attackers to inject content into a TLS session (CVE-2009-3555 class). FortiWeb's SSL inspection options include inspecting and blocking insecure renegotiation, enforcing only the secure renegotiation extension (RFC 5746).

Question 22FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb component preserves real-client IP for back-end logs when SNAT is in use?

  1. XFF (X-Forwarded-For) header insertion Correct answer.
  2. SSL Offload
  3. Anti-Defacement
  4. Compression

Explanation

With Source NAT, the back-end server sees the FortiWeb interface IP. To preserve the real client IP, FortiWeb inserts X-Forwarded-For (or X-Real-IP) headers. The application server is configured to read those headers for logging and access decisions.

Question 23FortiWeb-style application protection, API controls and measured tuning

During an SSL inspection deployment, the certificate chain returned to the client must include:

  1. Server leaf cert + any intermediate CAs Correct answer.
  2. Only the client root
  3. FortiGuard root
  4. FortiSandbox cert

Explanation

To avoid browser warnings, FortiWeb must serve the server's leaf certificate plus any intermediates back to the client. Skipping intermediates breaks chain validation on devices that don't have the intermediate cached. Roots come from the client trust store; FortiWeb does not need to send them.

Question 24FortiWeb-style application protection, API controls and measured tuning

Which inspection profile bundles signatures, parameter validation, file upload, and other Layer 7 controls into one re-usable object?

  1. Server Policy
  2. Web Protection Profile Correct answer.
  3. Server Pool
  4. Network Service

Explanation

The Web Protection Profile (WPP) is the central container that references signature sets, input validation rules, file upload restrictions, cookie security, hidden field protection, URL access rules, and more. The Server Policy then applies the WPP to a Virtual Server / Server Pool pair. WPPs come in Inline Standard, Inline Extended, Offline, and other templates.

Question 25FortiWeb-style application protection, API controls and measured tuning

Which signature category in FortiWeb is specifically designed to detect SQL injection, cross-site scripting, and other OWASP Top 10 web exploits?

  1. Information Disclosure
  2. Generic Attacks Correct answer.
  3. Trojan signatures
  4. Bad Robot signatures

Explanation

The Generic Attacks signature category covers the classic web exploits in the OWASP Top 10 - SQL injection (SQLi), cross-site scripting (XSS), command injection, remote/local file inclusion, server-side template injection, and similar. Information Disclosure focuses on leakage of paths or stack traces. Trojan and Bad Robot signatures address malware and crawlers respectively.

Question 26FortiWeb-style application protection, API controls and measured tuning

Where does FortiWeb get the signature definitions used by the Web Protection Profile?

  1. FortiGuard updates Correct answer.
  2. Manual customer authoring only
  3. FortiClient EMS
  4. Pearson VUE feed

Explanation

FortiGuard pushes signed signature, IP reputation, antivirus, geo IP, and credential stuffing updates to FortiWeb. The administrator can also create custom signatures, but the default protection set comes from a current FortiGuard subscription. Without an active subscription, signatures still load but stop receiving updates.

Question 27FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb feature checks that the values of HTML form parameters match a defined regex or data type before they reach the application?

  1. Parameter Validation Correct answer.
  2. Cookie Security
  3. HTTP Method Check
  4. Geo IP

Explanation

Parameter Validation rules let an administrator define each parameter's allowed type (integer, email, alphanumeric, regex, etc.), maximum length, and required flag. Requests that violate the schema are blocked or alerted. This is one of FortiWeb's positive-security controls and complements the negative-security signature engine.

Question 28FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb feature digitally signs hidden form fields so the WAF can detect tampering when the form is submitted back?

  1. Hidden Fields Protection Correct answer.
  2. Cookie Poisoning
  3. Session Management
  4. Anti-Defacement

Explanation

Hidden Fields Protection inspects the response, identifies <input type="hidden"> fields, signs or fingerprints them, and verifies on submission that the fields were not modified by the client. This blocks classic price-tampering and order-manipulation attacks. Cookie Poisoning protection performs the same idea but for cookies.

Question 29FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb control limits which URLs on a protected site can be requested by clients?

  1. URL Access Rule Correct answer.
  2. HTTP Header Security
  3. Brute Force Login
  4. Cache Rule

Explanation

URL Access (also called URL Access Rule or Allowed URL list) lets the administrator define a positive list of permitted URL patterns. Requests that fall outside the list are denied. Combined with HTTP Method allow-list, this provides positive-security path protection for web applications with known endpoints.

Question 30FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb feature protects against unauthorized large or malicious file uploads to the application?

  1. File Upload Restriction Correct answer.
  2. File Compression
  3. Anti-Defacement
  4. Content Routing

Explanation

File Upload Restriction lets the admin limit uploads by extension, MIME type, file size, file signature, and number per session. Combined with antivirus and FortiSandbox scanning, it prevents arbitrary file upload (a frequent OWASP Top 10 attack). Anti-Defacement protects published content from changes, not uploads.

Question 31FortiWeb-style application protection, API controls and measured tuning

Which token does FortiWeb insert into responses to defeat Cross-Site Request Forgery (CSRF) attacks?

  1. A nonce or anti-CSRF token Correct answer.
  2. A FortiGuard licence key
  3. A JWT signed by the back-end
  4. A FortiSandbox hash

Explanation

CSRF Protection on FortiWeb injects a cryptographic anti-CSRF token (nonce) into HTML forms in protected responses, then validates the token's presence and integrity on subsequent state-changing requests. Requests missing or carrying invalid tokens are blocked. JWTs are bearer tokens used in API auth, not CSRF defense.

Question 32FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb feature rewrites Set-Cookie headers to add HttpOnly, Secure, and SameSite attributes?

  1. Cookie Security Correct answer.
  2. Cookie Poisoning
  3. Hidden Fields
  4. HTTP Header Security

Explanation

Cookie Security automatically adds (or enforces) HttpOnly, Secure, and SameSite attributes to Set-Cookie headers from the back end. This is the cleanest way to harden cookies without modifying application code. Cookie Poisoning instead signs cookies and detects tampering on subsequent requests.

Question 33FortiWeb-style application protection, API controls and measured tuning

FortiWeb's Cookie Poisoning protection works primarily by:

  1. Encrypting all cookies with AES-256
  2. Signing cookie values and verifying integrity on submission Correct answer.
  3. Blocking all cookies from third-party domains
  4. Rewriting cookies to lowercase

Explanation

Cookie Poisoning protection fingerprints/signs cookies on the response and validates the signature when the client returns them. Tampered cookies cause the request to be blocked or sanitized. This addresses authentication/authorization attacks where attackers modify a session or role cookie.

Question 34FortiWeb-style application protection, API controls and measured tuning

Which security headers can FortiWeb insert via HTTP Header Security to harden the response?

  1. Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options Correct answer.
  2. User-Agent and Referer
  3. If-Modified-Since
  4. Cookie and Set-Cookie only

Explanation

FortiWeb's HTTP Header Security can add or rewrite hardening headers including Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, and Content-Security-Policy. These headers harden the browser's behavior without changing the application.

Question 35FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb feature periodically checksums protected files on the back-end web server and alerts on changes?

  1. Anti-Defacement Correct answer.
  2. Cookie Poisoning
  3. Caching
  4. XFF insertion

Explanation

Anti-Defacement copies a baseline of protected web pages, calculates checksums, and compares periodically. If pages change unexpectedly (defacement, malware injection), FortiWeb alerts and can serve a saved clean copy until the issue is resolved. This requires SSH or FTP credentials to the protected server.

Question 36FortiWeb-style application protection, API controls and measured tuning

FortiWeb's brute-force login protection blocks clients based on:

  1. Failed login attempts to a configured login URL within a time window Correct answer.
  2. Total bandwidth used
  3. Random IP sampling
  4. Cookie size only

Explanation

Brute Force Login monitors a configured login URL and counts failed attempts per source IP. When the threshold within the time window is exceeded, FortiWeb blocks or challenges the source. This defends against credential brute-force and spraying attacks.

Question 37FortiWeb-style application protection, API controls and measured tuning

Which HTTP method check feature lets administrators allow only GET, POST, and PUT on a specific URL?

  1. HTTP Method Allow-list Correct answer.
  2. Cookie Security
  3. Geo IP
  4. SSL Offload

Explanation

HTTP Method Allow-list (or HTTP Method Check) defines which verbs are permitted per URL or globally. Requests using disallowed methods (DELETE, TRACE, CONNECT, PROPFIND, etc.) are blocked. This is part of FortiWeb's positive-security toolkit.

Question 38FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb action results in the request being silently dropped without informing the client?

  1. Deny (no log) / Drop Correct answer.
  2. Alert only
  3. Redirect
  4. Pass-through

Explanation

A Deny / Drop action discards the request without sending an HTTP response, which can frustrate scanners. "Deny" with custom message returns an HTTP error page. Alert-only logs without blocking. Pass-through forwards even on a match (used for tuning).

Question 39FortiWeb-style application protection, API controls and measured tuning

Which signature action puts an offender into the temporary block list ("Period Block")?

  1. Block period (Period Block) Correct answer.
  2. Pass action
  3. Alert only
  4. Redirect

Explanation

Period Block (also called Block Period) puts the offending source IP/session in a temporary deny list for a configured number of seconds. Subsequent requests are blocked without re-running inspection. This is useful against scanners and brute-force attackers.

Question 40FortiWeb-style application protection, API controls and measured tuning

What is the purpose of the Trigger Action in a FortiWeb policy element?

  1. Define which logging, email, and SNMP alert is generated when the rule matches Correct answer.
  2. Override the SSL certificate
  3. Replace the back-end pool
  4. Disable the WPP

Explanation

The Trigger Action (sometimes called Trigger Policy) specifies what notification side-effects occur on a match - log severity, email recipients, SNMP traps, FortiAnalyzer events. The Action setting controls whether the request is allowed/blocked; the Trigger controls what alerts fire.

Question 41FortiWeb-style application protection, API controls and measured tuning

Which feature limits the maximum body size that FortiWeb will accept on a POST or PUT request?

  1. HTTP Constraints (request length limits) Correct answer.
  2. Cache Rule
  3. SSL Offload
  4. Trigger Action

Explanation

HTTP Constraints (also called HTTP Protocol Constraints) enforce maximums on request length, header count, header size, body size, parameter count, and similar. They defend against memory-exhaustion DoS and oversized payload attacks. Cache rules deal with response storage, not request size.

Question 42FortiWeb-style application protection, API controls and measured tuning

What does the Information Disclosure signature category attempt to detect?

  1. Leakage of stack traces, server banners, paths, or sensitive errors in responses Correct answer.
  2. SQL injection in requests
  3. Bot User-Agent strings
  4. File upload viruses

Explanation

Information Disclosure signatures inspect response bodies and headers for stack traces, framework banners, file paths, database errors, ASP.NET debug pages, and other leakage that helps an attacker fingerprint the application. FortiWeb can block or rewrite the response.

Question 43FortiWeb-style application protection, API controls and measured tuning

Which FortiWeb feature is recommended to prevent ClickJacking?

  1. Adding the X-Frame-Options or CSP frame-ancestors header Correct answer.
  2. Antivirus scan
  3. Compression
  4. Caching

Explanation

ClickJacking is mitigated by sending X-Frame-Options DENY/SAMEORIGIN or a Content-Security-Policy frame-ancestors directive. FortiWeb's HTTP Header Security feature inserts these headers automatically, so administrators don't need to modify the application.

Question 44FortiWeb-style application protection, API controls and measured tuning

On FortiWeb, which auto-learning data is gathered when the Auto-Learning feature is enabled?

  1. Observed URLs, parameters, and value patterns plus suggested rules Correct answer.
  2. FortiGuard signature releases
  3. Customer license keys
  4. Heartbeat statistics

Explanation

Auto-Learning observes legitimate traffic for a configurable period and produces a report of URLs, parameters, value types, and ranges. The administrator can then accept the suggestions to seed Parameter Validation, URL Access, and Hidden Field rules - accelerating positive-security deployment.

Question 45FortiWeb-style application protection, API controls and measured tuning

FortiWeb's Web Vulnerability Scanner produces:

  1. A report of detected vulnerabilities in the protected application Correct answer.
  2. FortiSandbox malware verdicts
  3. Antivirus signatures
  4. Cloud bills

Explanation

The integrated Web Vulnerability Scanner crawls a defined target and reports SQL injection, XSS, missing security headers, weak SSL, and other findings. The report can be used to prioritize remediation or to create virtual patches as FortiWeb signatures.

Question 46FortiWeb-style application protection, API controls and measured tuning

What is virtual patching on FortiWeb?

  1. Creating a temporary WAF rule that blocks an exploit while the application code is being fixed Correct answer.
  2. Updating FortiOS firmware
  3. Patching FortiSandbox
  4. Generating a new SSL certificate

Explanation

Virtual patching (also "compensating control") is a WAF rule - signature, custom regex, parameter restriction - that blocks exploitation of a known application bug until developers ship a code fix. It is one of the WAF's highest-value use cases for security teams.

Question 47FortiWeb-style application protection, API controls and measured tuning

To achieve Zero Trust application access, which FortiWeb feature integrates with FortiAuthenticator/FortiToken to require user authentication before reaching the back end?

  1. Site Publishing / Application Delivery with SSO Correct answer.
  2. Anti-Defacement
  3. Caching
  4. SSL renegotiation

Explanation

Site Publishing (FortiWeb's authentication offload) requires users to authenticate to FortiWeb (via LDAP, RADIUS, SAML, Kerberos, FortiToken) before any request reaches the back end. It supports SSO methods like NTLM, Kerberos, and SAML, providing a Zero-Trust front door even for legacy applications.

Question 48FortiWeb-style application protection, API controls and measured tuning

To exclude a known false-positive signature on a specific URL only, the administrator should:

  1. Create a Signature Exception that disables that signature for the matching URL/parameter Correct answer.
  2. Delete the signature globally
  3. Disable the entire web protection profile
  4. Switch to Offline Detection

Explanation

Signature Exceptions let administrators surgically disable individual signatures for a specific host, URL, or parameter without weakening protection elsewhere. Deleting a signature globally would also remove genuine protection for unrelated paths.

Question 49FortiWeb-style application protection, API controls and measured tuning

Which order best describes FortiWeb's request inspection pipeline (high level)?

  1. Network ACLs → IP/Geo reputation → HTTP parsing → signatures/positive validation → ML/bot → policy action Correct answer.
  2. Signature → ACL → Cookie → DNS
  3. SSL handshake → DNS → IPS → Anti-Defacement
  4. FortiSandbox → Geo IP → Cookie → DNS

Explanation

FortiWeb processes a request in stages: network and ACL checks first, then IP/Geo reputation, then HTTP parsing, then signature and positive-security validation, then ML/bot scoring, and finally the configured action (allow, block, challenge). Understanding the order helps predict tuning effects and debug rule misses.

Question 50FortiWeb-style application protection, API controls and measured tuning

What does FortiWeb's Machine Learning (ML) anomaly detection learn during the initial collection phase?

  1. Normal application traffic patterns and parameter behavior Correct answer.
  2. Only the IP addresses of attackers
  3. User passwords
  4. FortiGuard subscription state

Explanation

The learning feature models observed application/request behavior to help identify deviations under the configured feature and version. Representative trustworthy input and actual training/validation matter; observed traffic is not automatically legitimate, and an anomaly is not proof of an attack. No particular statistical algorithm is asserted here.