Refer to the exhibit.You are a FortiWeb administrator. FortiWeb is deployed between a FortiGate and two back-end web servers, as shown in the diagram. No server policies are currently configured on FortiWeb.While testing, you notice that a student system in the 100.64.0.0/24 network is still able to access the back-end servers in 10.1.1.0/24, even though FortiWeb is not logging or inspecting the traffic.Which action should you take to ensure FortiWeb blocks or inspects all traffic before it reaches the back-end servers?
Answer(s): D
Disabling ip-forward prevents FortiWeb from acting as a simple Layer 3 forwarding device when no matching server policy exists. This ensures traffic cannot bypass FortiWeb inspection and will be blocked unless it matches a configured policy that allows FortiWeb to inspect or process it before reaching the back-end servers.
Which URL should you rewrite to reduce security risk?
Answer(s): A
The URL exposes a specific application version in the path. Rewriting it reduces information disclosure, making it harder for attackers to identify the application version and target known vulnerabilities.
You are setting up a FortiWeb policy to protect a customer login portal. Users connect to https:// login.training.lab, and you want FortiWeb to forward those requests to a load-balanced pool of back-end servers.Which three components must you configure to complete the server policy?
Answer(s): C
A FortiWeb server policy needs a virtual server to receive client traffic, a server pool to define the load-balanced back-end servers, and service/port settings so FortiWeb knows which traffic the policy should handle.
Refer to the exhibit.A FortiWeb administrator notices an alert triggered under the Threshold Based Detection category, with the message: Threshold Based Content Scraping Detection (Bot Detection) violation.Based on the log details, what is the most likely cause of this alert?
Threshold Based Content Scraping Detection indicates FortiWeb detected behavior consistent with automated content harvesting. This usually occurs when a client repeatedly or systematically accesses web pages in a pattern that exceeds configured thresholds, which is typical of a bot or scraping script attempting to extract site content.
Your e-commerce platform is experiencing frequent SQL injection attempts. You need FortiWeb to actively inspect, enforce, and block attacks inline before traffic reaches the web servers.The deployment must support the full FortiWeb security feature set without operational limitations, including protocol validation, attack detection, and policy enforcement.Which FortiWeb operation mode should you configure to proactively intercept and block threats such as SQL injection attempts?
Reverse proxy mode places FortiWeb inline as the termination point for client connections and allows it to fully inspect, validate, enforce policies, and block malicious requests before they reach the protected web servers. This mode provides the most complete FortiWeb security capability for proactively stopping SQL injection and other application-layer attacks.
Post your Comments and Discuss Fortinet NSE5_FWB_AD-8.0 exam prep with other Community members: