Under which two circumstances does FortiWeb use its own certificates? (Choose two.)

Making a secondary HTTPS connection to a server where FortiWeb acts as a client

An administrator session connecting to the GUI using HTTPS

Connecting to browser clients using SSL

Making a secondary HTTPS connection to a server where FortiWeb acts as a client

Routing an HTTPS connection to a FortiGate

An administrator session connecting to the GUI using HTTPS

You are using HTTP content routing on FortiWeb. You want requests for web application A to be forwarded to a cluster of web servers, which all host the same web application. You want requests for web application B to be forwarded to a different, single web server.Which statement regarding this solution is true?

You must put the single web server for application B into a server pool and use it with HTTP content routing.

You must chain policies so that all requests go to the virtual server for policy A first, and then redirect requests for web application B to go to the virtual server for policy B

You must create static routes on the FortiWebto allow these requests.

You must put the single web server for application B into a server pool and use it with HTTP content routing.

The server policy always applies the same web protection profile to both web application A and web application B.

What are two results of enabling monitor mode on FortiWeb? (Choose two.)

It does not affect denial-of-service (DoS) protection profile actions to rate limit traffic.

It overrides all usual profile actions. FortiWeb accepts all requests and generates alert email or log messages only for violations.

It does not affect denial-of-service (DoS) protection profile actions to rate limit traffic.

It uses the default action for all profiles and, depending on the configuration, blocks or allows traffic.

It does not affect any HTML rewriting or redirection actions in web protection profiles.

It overrides all usual profile actions. FortiWeb accepts all requests and generates alert email or log messages only for violations.

Which implementation is most suited for a deployment that must meet PCI DSS compliance criteria?

SSL offloading with FortiWeb in PCI DSS mode

SSL offloading with FortiWeb in reverse proxy mode

SSL offloading with FortiWeb in PCI DSS mode

SSL offloading with FortiWeb in transparency mode

SSL offloading with FortiWeb in full transparent proxy mode

Review the following configuration: What are two routing behaviors that you can expect on FortiWeb after this configuration change? (Choose two.)

Non-HTTP traffic routed through the FortiWeb is allowed.

Non-HTTP traffic destined to the FortiWeb virtual server IP address is dropped.

Non-HTTP traffic routed through the FortiWeb is allowed.

Non-HTTP traffic destined to the FortiWeb virtual server IP address is dropped.

Only ICMP traffic is allowed. All other traffic is dropped.

An attacker attempts to send an SQL injection attack containing the known attack string 'root'; -- through an API call.Which FortiWeb inspection feature will be able to detect this attack the quickest?

Machine learning (ML)-based API protection---anomaly detection

ML-based API protection---threat detection

Refer to the exhibit. What are two additional configuration elements that you must be configure for this API gateway? (Choose two.)

You must select a setting in the Allow User Group field.

You must enable and configure Host Status.

Which would be a reason to implement HTTP rewriting?

To replace a vulnerable element in a requested URL.

The original page has moved to a new URL.

What is the difference between an API gateway protection schema and a machine learning (ML) API protection schema?

An API gateway protection schema supports data types other than string.

An API gateway protection schema does not allow authentication.

An API gateway protection schema handles response bodies.

An API gateway protection schema supports data types other than string.

An API gateway protection schema cannot change without administrator intervention.

Refer to the exhibits. What will happen when a client attempts a mousedown cross-site scripting (XSS) attack against the site http://my.blog.org/userl1/blog.php and FortiWeb is enforcing the highlighted signature?

The connection will be allowed.

The connection will be stripped of the mousedown JavaScript code.

The connection will be blocked as an XSS attack.

FortiWeb will report the new mousedown attack to FortiGuard.

The connection will be allowed.

What can a FortiWeb administrator do if a client has been incorrectly period blocked?

Manually release the IP address from the blocklist.

Allow the period block to expire on its own, you cannot override it.

Manually release the IP address from the blocklist.

Disable and re-enable the server policy.

Force a new IP address to the client.

Which two functions does the first layer of the FortiWeb anomaly machine learning (ML) analysis mechanism perform? (Choose two.)

Determines a probability model behind every parameter and HTTP method passing through FortiWeb

Determines whether traffic is an anomaly, based on observable features overtime

Determines whether an anomaly is a real attack or just a harmless anomaly that should be ignored

Determines a probability model behind every parameter and HTTP method passing through FortiWeb

Determines whether traffic is an anomaly, based on observable features overtime

Determines if a detected threat is a false-positive or not

Which is an example of a cross-site scripting (XSS) attack?

SELECT username FROM accounts WHERE username='admin';-- ' AND password='password';

SELECT username FROM accounts WHERE username='XSS' ' AND password='alert('http://badurl.com')';

Which command will enable debugging for the FortiWeb user tracking feature?

diagnose debug application user-cracking 7

debug application user-cracking 7

diagnose debug enable user-cracking 7

Refer to the exhibit. What is true about this FortiWeb device? (Choose two.)

It was upgraded to a different version after initial installation.

It has 41% of the disk available for logging.

It was upgraded to a different version after initial installation.

It is currently running version 6.4.0.

It is currently running version 6.4.1.

What are two possible impacts of a DoS attack on your web server? (Choose two.)

The web application is unable to accept any more connections because of network socket exhaustion.

The web application server is unable to accept new client sessions due to memory exhaustion.

The web application starts accepting unencrypted traffic.

The web application is unable to accept any more connections because of network socket exhaustion.

The web application server is unable to accept new client sessions due to memory exhaustion.

The web application server database is compromised with data theft.

Which two statements about running a vulnerability scan are true? (Choose two.)

You should run the vulnerability scan during a maintenance window.

You should run the vulnerability scan in a test environment.

You should run the vulnerability scan during a maintenance window.

You should run the vulnerability scan multiple times so it can automatically update the scan parameters.

You should run the vulnerability scan in a test environment.

You should run the vulnerability scan on the live website to get accurate results.

An administrator notices multiple IP addresses attempting to log in to an application frequently, within a short time period. They suspect attackers are attempting to guess user passwords for a secure application.What is the best way to limit this type of attack on FortiWeb, while still allowing legitimate traffic through?

Configure a brute force login custom policy.

Rate limit all connections from suspected IP addresses.

Block the IP address at the border router.

Review the following configuration: Which result would you expect from this configuration setting?

When ML is in its running phase, FortiWeb will accept an unlimited number of samples from the same source IP address.

When machine learning (ML) is in its running phase, FortiWeb will accept a set number of samples from the same source IP address.

When ML is in its running phase, FortiWeb will accept an unlimited number of samples from the same source IP address.

When ML is in its collecting phase, FortiWeb will accept an unlimited number of samples from the same source IP address.

When ML is in its collecting phase, FortiWeb will not accept any samples from any IP addresses.

Refer to the exhibit. What can you conclude from this support vector machine (SVM) plot of a potential bot connection?

The connection is possibly a bot.

The connection is normal and within the expected averages.

The connection uses too much bandwidth.

The connection uses an excessive amount of TCP connections, but is harmless.

The connection is possibly a bot.

When is it possible to use a self-signed certificate, rather than one purchased from a commercial certificate authority?

If you are an enterprise whose computers all trust the active directory or CA server that signed the certificate

If you are an enterprise whose employees use only mobile devices

If you are a small business or home office

If you are an enterprise whose computers all trust the active directory or CA server that signed the certificate

If you are an enterprise whose resources do not need security or https connections

Refer to the exhibit. Which statement is true?

FortiWeb is decrypting and re-encrypting the traffic.

FortiWeb cannot perform content inspection on the traffic because it is encrypted.

FortiWeb is decrypting and re-encrypting the traffic.

The server is not performing any cryptography on the traffic.

The server is encrypting traffic being sent to the client.

How are bot machine learning (ML) models different from API or anomaly detection models?

Bot ML models analyze multiple connections overtime instead analyzing each connection as a single unit.

Bot ML models detect only anomalies and not actual threats.

Bot ML models inspect more types of connection properties.

Bot ML models do not update models periodically from new data.

Which three security features must you configure on FortiWeb to protect API connections? (Choose three.)

Machine learning (ML)-based API protection

Single sign-on (SSO) authentication with Active Directory (AD)

Machine learning (ML)-based API protection

API user authentication with SAML

Refer to the exhibit. FortiADC is applying SNAT to all inbound traffic going to the servers.When an attack occurs, FortiWeb blocks traffic based on the 192.0.2.1 source IP address, which belongs to FortiADC. This setup is breaking all connectivity and genuine clients are not able to access the servers.What can the administrator do to avoid this problem? (Choose two.)

Place FortiWeb in front of FortiADC.

Enable and configure the Use X-Forwarded-For setting on FortiWeb.

Enable and configure the Preserve Client IP setting on the client.

No special configuration is required; connectivity will be re-established for all clients after the set timeout.

Place FortiWeb in front of FortiADC.

Enable and configure the Use X-Forwarded-For setting on FortiWeb.

A customer wants to be able to index your websites for search and advertisement purposes.What is the easiest way to allow this on a FortiWeb?

Add the indexer IP address to the trusted IP list on the FortiWeb.

Add the indexer IP address to the FortiGuard 'Known Search Engines' category.

Create a firewall rule to bypass the FortiWeb entirely for the indexer IP address.

Do not allow any external sites to index your websites.

Refer to the exhibit. A FortiWeb device is deployed upstream of a device performing source network address translation (SNAT) or load balancing.What configuration must you perform on FortiWeb to preserve the original IP address of the client?

Enable and configure the Preserve Client IP setting.

Use a transparent operating mode on FortiWeb.

Enable and configure the Add X-Forwarded-For setting.

Refer to the exhibit. Attack ID 20000010 is brute force logins.Which statement is accurate about the potential attack?

192.168.1.11 is sending suspicious traffic to FortiWeb.

The attacker has successfully retrieved the credentials to www.example.com.

www.example.com is running attacks against the client 192.168.1.11.

The attack has happened 10 times.

192.168.1.11 is sending suspicious traffic to FortiWeb.

Fortinet FCP_FWB_AD-7.4 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 36

Which high availability mode is commonly used to integrate with a traffic distributer like FortiADC?

Cold standby

Load sharing

Active-Active

Active-Passive

Comment (0)

Fortinet FCP_FWB_AD-7.4 Practice Test 1

Question

Fortinet FCP_FWB_AD-7.4 Practice Tests

Practice Tests