Ask Question
Fortinet FCP_FWB_AD-7.4 Practice Test - Questions Answers
Add to Whishlist
List of questions
Question 1
Which high availability mode is commonly used to integrate with a traffic distributer like FortiADC?
Cold standby
Load sharing
Active-Active
Active-Passive
In Fortinet's high availability (HA) configurations, integrating FortiWeb with a traffic distributor like FortiADC is best achieved using the Active-Active HA mode. This mode allows multiple FortiWeb appliances to operate simultaneously, distributing traffic loads and enhancing both performance and redundancy.
FortiWeb supports several HA modes:
Active-Passive: One appliance actively handles all traffic, while the other remains on standby, ready to take over if the active unit fails.
Active-Active: Multiple appliances actively process traffic concurrently, sharing the load and providing redundancy.
High Volume Active-Active: An enhanced version of Active-Active, designed for environments with exceptionally high traffic volumes.
When integrating with a traffic distributor like FortiADC, the Active-Active mode is particularly advantageous. FortiADC can intelligently distribute incoming traffic across multiple active FortiWeb appliances, optimizing resource utilization and ensuring high availability. This setup not only balances the load but also provides fault tolerance; if one appliance becomes unavailable, FortiADC can redirect traffic to the remaining active units without service interruption.
This collaborative approach between FortiWeb and FortiADC ensures that web applications remain secure, performant, and resilient against failures.
Question 2
Under which two circumstances does FortiWeb use its own certificates? (Choose two.)
Connecting to browser clients using SSL
Making a secondary HTTPS connection to a server where FortiWeb acts as a client
Routing an HTTPS connection to a FortiGate
An administrator session connecting to the GUI using HTTPS
Making a secondary HTTPS connection to a server where FortiWeb acts as a client: When FortiWeb needs to connect to an external server via HTTPS (acting as a client), it may use its own certificates for that connection.
An administrator session connecting to the GUI using HTTPS: FortiWeb uses its own certificates to secure the HTTPS connection between the administrator and the FortiWeb GUI. This ensures secure access for management purposes.
Question 3
You are using HTTP content routing on FortiWeb. You want requests for web application A to be forwarded to a cluster of web servers, which all host the same web application. You want requests for web application B to be forwarded to a different, single web server.
Which statement regarding this solution is true?
You must chain policies so that all requests go to the virtual server for policy A first, and then redirect requests for web application B to go to the virtual server for policy B
You must create static routes on the FortiWebto allow these requests.
You must put the single web server for application B into a server pool and use it with HTTP content routing.
The server policy always applies the same web protection profile to both web application A and web application B.
To forward requests for web application B to a single web server, you would configure FortiWeb to use HTTP content routing and create a server pool specifically for web application B. In FortiWeb, server pools are used to group servers together based on application requirements, and you can configure the pool to contain only a single web server for application B.
Question 4
What are two results of enabling monitor mode on FortiWeb? (Choose two.)
It does not affect denial-of-service (DoS) protection profile actions to rate limit traffic.
It uses the default action for all profiles and, depending on the configuration, blocks or allows traffic.
It does not affect any HTML rewriting or redirection actions in web protection profiles.
It overrides all usual profile actions. FortiWeb accepts all requests and generates alert email or log messages only for violations.
It does not affect denial-of-service (DoS) protection profile actions to rate limit traffic: Monitor mode allows FortiWeb to monitor traffic without impacting the protection profile actions, including rate limiting in the DoS protection profiles. Traffic will still be subjected to DoS protection actions like rate limiting, but FortiWeb will not block traffic unless a violation occurs.
It overrides all usual profile actions. FortiWeb accepts all requests and generates alert email or log messages only for violations: In monitor mode, FortiWeb will allow all traffic through and generate logs or alerts for any violations, but it will not take active actions like blocking requests or redirecting traffic. This allows you to observe the traffic patterns and potential threats without disrupting normal operations.
Question 5
Which implementation is most suited for a deployment that must meet PCI DSS compliance criteria?
SSL offloading with FortiWeb in reverse proxy mode
SSL offloading with FortiWeb in PCI DSS mode
SSL offloading with FortiWeb in transparency mode
SSL offloading with FortiWeb in full transparent proxy mode
The Payment Card Industry Data Security Standard (PCI DSS) sets forth security requirements to protect cardholder data. Requirement 6.6 specifically mandates that public-facing web applications be protected against known attacks by either:Exclusive Networks+3Gordion+3layer7solutions.com+3
Reviewing applications via manual or automated vulnerability security assessment tools or methods, at least annually and after any changes.
Installing an automated technical solution that detects and prevents web-based attacks, such as a web application firewall (WAF), in front of public-facing web applications to continually inspect all traffic.
FortiWeb, Fortinet's web application firewall, offers various deployment modes to protect web applications:
Reverse Proxy Mode: FortiWeb acts as an intermediary, terminating client sessions and initiating sessions to the backend servers. This mode provides comprehensive protection and allows for features like SSL offloading, URL rewriting, and advanced routing capabilities.
Transparent Mode: FortiWeb operates at Layer 2, inspecting traffic without modifying it, making it invisible to both clients and servers. This mode simplifies deployment as it doesn't require changes to the existing network topology.
Full Transparent Proxy Mode: Combines aspects of both reverse proxy and transparent modes, providing inspection and modification capabilities while remaining transparent to network devices.
PCI DSS Mode: A specialized deployment tailored to meet PCI DSS compliance requirements. This mode ensures that FortiWeb is configured with security policies and features aligned with PCI DSS standards, offering robust protection against threats targeting cardholder data.
Given the need to meet PCI DSS compliance criteria, deploying FortiWeb in PCI DSS mode is the most appropriate choice. This mode is specifically designed to align with PCI DSS requirements, ensuring that all necessary security measures are in place to protect cardholder data
Question 6
Review the following configuration:
What are two routing behaviors that you can expect on FortiWeb after this configuration change? (Choose two.)
Non-HTTP traffic routed through the FortiWeb is allowed.
IPv6 routing is enabled.
Non-HTTP traffic destined to the FortiWeb virtual server IP address is dropped.
Only ICMP traffic is allowed. All other traffic is dropped.
FortiWeb is primarily designed to handle HTTP and HTTPS traffic, protecting web applications from various threats. By default, when operating in reverse proxy mode, FortiWeb does not forward non-HTTP/HTTPS protocols to protected servers. However, administrators can configure FortiWeb to handle non-HTTP/HTTPS traffic differently using the config router setting command. This command allows enabling IP-based forwarding (routing) for non-HTTP/HTTPS traffic. When enabled, FortiWeb can route non-HTTP traffic through itself to the appropriate backend servers.
Despite this capability, any non-HTTP/HTTPS traffic that is destined directly for a FortiWeb virtual server IP address is dropped. This means that while FortiWeb can be configured to forward non-HTTP/HTTPS traffic to backend servers, it will not process non-HTTP/HTTPS traffic targeted at its own virtual server IPs.
Regarding IPv6 routing, FortiWeb does support IPv6 in various operation modes, including reverse proxy, offline inspection, and transparent inspection. However, enabling IPv6 routing requires specific configurations and is not automatically enabled by default.
Question 7
An attacker attempts to send an SQL injection attack containing the known attack string 'root'; -- through an API call.
Which FortiWeb inspection feature will be able to detect this attack the quickest?
Unlock Premium Member
Question 8
Refer to the exhibit.
What are two additional configuration elements that you must be configure for this API gateway? (Choose two.)
Question 9
Which would be a reason to implement HTTP rewriting?
Question 10
What is the difference between an API gateway protection schema and a machine learning (ML) API protection schema?
Related questions
Export
If you didn't receive an email within 5 minutes, you should submit a support request to [email protected].
|
BASIC - 1 Month
$
3
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
PLUS - 2 Months
$
10
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
PRO - 6 Months
$
20
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
|
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Full latest questions
No CAPTCHA
New Updates
Export to VPLUS
Export to PDF - All questions
Team support
Selling illegal goods, money scams etc.
Serious attack on a group.
Harassing an individual (including doxing)
Threatening or glorifying violence or serious harm, including self-harm
Nudity/Sexual content
Sexually explicit or suggestive imagery or writing involving minors
Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans
Reusing content without attribution (link and blockquotes)
Not in English or has very bad formatting, grammar, and spelling
Author's credential is offensive, spam, or impersonation
Ex. Illegal content, incomplete question...
Question