Refer to the exhibit.A FortiWeb administrator tests a new form input value after training the machine learning (ML) anomaly detection system.The hidden Markov model (HMM) flags the input as abnormal, while the support vector machine (SVM) model classifies it as normal. FortiWeb allows the request.What does this result indicate about the FortiWeb ML anomaly detection behavior?
Answer(s): A
FortiWeb ML anomaly detection uses multiple models to evaluate whether input is truly malicious or simply unusual. In this case, the input appears abnormal to the HMM pattern model, but the SVM classification considers it acceptable, so FortiWeb treats it as normal and allows the request.
A third-party penetration test reveals that users can bypass login controls through a mobile API. Your current FortiWeb configuration includes zero trust network access (ZTNA) profiles and cookie security, but API protection and client management are not enabled. The security team asks you to recommend the most effective way to close this gap.Which FortiWeb adjustment would best prevent future unauthorized API access?
Answer(s): B
API protection and client management are designed to control and validate access to API endpoints, including mobile API traffic. Enabling them allows FortiWeb to apply identity-aware checks, manage API clients, and prevent unauthorized access paths that are not adequately protected by cookie security alone.
Which statement best describes the difference between SAML authentication and HTML authentication in FortiWeb site publishing?
SAML authentication relies on an external identity provider to authenticate the user and return an assertion to FortiWeb. HTML authentication uses a FortiWeb-hosted login page or form-based authentication process where FortiWeb directly handles the user login workflow for the published site.
Refer to the exhibit.You are deploying FortiWeb to handle HTTPS traffic from clients and forward cleartext traffic to a back-end server.You want FortiWeb to decrypt the HTTPS session, inspect the traffic, and then send the traffic to the server using HTTP.What can you configure on FortiWeb to make this behavior happen?
Answer(s): D
SSL offloading allows FortiWeb to terminate the client HTTPS connection, decrypt and inspect the traffic, and then forward the request to the back-end server over HTTP. This provides inspection while removing the SSL processing requirement from the server.
A user from group B sends 150 requests in one minute to this endpoint:Group B users are allowed access to only /api/v1/reports and are limited to 50 requests per minute.What should the FortiWeb administrator configure to stop this abuse?
Group-based rate limiting enforces the allowed request threshold for group B users, limiting them to 50 requests per minute and preventing excessive API use even when the request includes a valid API key.
Post your Comments and Discuss Fortinet NSE5_FWB_AD-8.0 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the NSE5_FWB_AD-8.0 content, but please register or login to continue.