Which two statements about the anti-defacement feature on FortiWeb are true? (Choose two.)

FortiWeb will only check to see if there are changes on the web server; it will not download the whole file each time.

Anti-defacement does not make a backup copy of your databases.

Anti-defacement can redirect users to a backup web server, if it detects a change.

Anti-defacement downloads a copy of your website to RAM, in order to restore a clean image, if it detects defacement.

FortiWeb will only check to see if there are changes on the web server; it will not download the whole file each time.

Anti-defacement does not make a backup copy of your databases.

What role does FortiWeb play in ensuring PCI DSS compliance?

PCI specifically requires a WAF

Provides credit card processing capabilities

Provide ability to securely process cash transactions

Provides load balancing between multiple web servers

Which implementation is best suited for a deployment that must meet compliance criteria?

SSL Inspection with FrotiWeb in Reverse Proxy mode

SSL Inspection with FortiWeb in Transparency mode

SSL Offloading with FortiWeb in reverse proxy mode

SSL Inspection with FrotiWeb in Reverse Proxy mode

SSL Offloading with FortiWeb in Transparency Mode

What must you do with your FortiWeb logs to ensure PCI DSS compliance?

Enable masking of sensitive data

Compress them into a .zip file format

What role does FortiWeb play in ensuring PCI DSS compliance?

It provides the WAF required by PCI.

It provides the ability to securely process cash transactions.

It provides the required SQL server protection.

It provides the WAF required by PCI.

It provides credit card processing capabilities.

Refer to the exhibit. There is only one administrator account configured on FortiWeb. What must an administrator do to restrict any brute force attacks that attempt to gain access to the FortiWeb management GUI?

Configure IPv4 Trusted Host # 3 with a specific IP address.

Delete the built-in administrator user and create a new one.

Configure IPv4 Trusted Host # 3 with a specific IP address.

The configuration changes must be made on the upstream device.

Change the Access Profile to Read_Only.

What key factor must be considered when setting brute force rate limiting and blocking?

Multiple clients sharing a single Internet connection

A single client contacting multiple resources

Multiple clients sharing a single Internet connection

Multiple clients from geographically diverse locations

Multiple clients connecting to multiple resources

Refer to the exhibits. FortiWeb is configured in reverse proxy mode and it is deployed downstream to FortiGate. Based on the configuration shown in the exhibits, which of the following statements is true?

FortiGate should forward web traffic to virtual server IP address.

FortiGate should forward web traffic to the server pool IP addresses.

The configuration is incorrect. FortiWeb should always be located upstream to FortiGate.

You must disable the Preserve Client IP setting on FotriGate for this configuration to work.

FortiGate should forward web traffic to virtual server IP address.

Which two statements about running a vulnerability scan are true? (Choose two.)

You should run the vulnerability scan during a maintenance window.

You should run the vulnerability scan in a test environment.

You should run the vulnerability scan during a maintenance window.

You should run the vulnerability scan in a test environment.

Vulnerability scanning increases the load on FortiWeb, so it should be avoided.

You should run the vulnerability scan on a live website to get accurate results.

Which would be a reason to implement HTTP rewriting?

To replace a vulnerable function in the requested URL

The original page has moved to a new URL

To replace a vulnerable function in the requested URL

To send the request to secure channel

The original page has moved to a new IP address

Refer to the exhibit. FortiADC is applying SNAT to all inbound traffic going to the servers. When an attack occurs, FortiWeb blocks traffic based on the 192.0.2.1 source IP address, which belongs to FortiADC. The setup is breaking all connectivity and genuine clients are not able to access the servers.What must the administrator do to avoid this problem? (Choose two.)

Enable the Use X-Forwarded-For setting on FortiWeb.

Place FortiWeb in front of FortiADC.

Enable the Use X-Forwarded-For setting on FortiWeb.

No Special configuration is required; connectivity will be re-established after the set timeout.

Place FortiWeb in front of FortiADC.

Enable the Add X-Forwarded-For setting on FortiWeb.

Which statement about local user accounts is true?

They cannot be used for site publishing.

They are best suited for large environments with many users.

They cannot be used for site publishing.

They must be assigned, regardless of any other authentication.

Refer to the exhibit. Based on the configuration, what would happen if this FortiWeb were to lose power? (Choose two.)

Traffic will be interrupted between port3 and port4.

Traffic will pass between port5 and port6 uninspected.

Traffic that passes between port5 and port6 will be inspected.

Traffic will be interrupted between port3 and port4.

All traffic will be interrupted.

Traffic will pass between port5 and port6 uninspected.

Refer to the exhibit. FortiWeb is configured to block traffic from Japan to your web application server. However, in the logs, the administrator is seeing traffic allowed from one particular IP address which is geo-located in Japan.What can the administrator do to solve this problem? (Choose two.)

If the IP address is configured as a geo reputation exception, remove it.

Configure the IP address as a blacklisted IP address.

Manually update the geo-location IP addresses for Japan.

If the IP address is configured as a geo reputation exception, remove it.

Configure the IP address as a blacklisted IP address.

If the IP address is configured as an IP reputation exception, remove it.

A client is trying to start a session from a page that would normally be accessible only after the client has logged in.When a start page rule detects the invalid session access, what can FortiWeb do? (Choose three.)

Redirect the client to the login page

Allow the page access, but log the violation

Reply with a 403 Forbidden HTTP error

Display an access policy message, then allow the client to continue

Redirect the client to the login page

Allow the page access, but log the violation

Prompt the client to authenticate

Reply with a 403 Forbidden HTTP error

Refer to the exhibit. Many legitimate users are being identified as bots. FortiWeb bot detection has been configured with the settings shown in the exhibit. The FortiWeb administrator has already verified that the current model is accurate.What can the administrator do to fix this problem, making sure that real bots are not allowed through FortiWeb?

Change Action under Action Settings to Alert

Disable Dynamically Update Model

What can an administrator do if a client has been incorrectly period blocked?

Manually release the ID address from the temporary blacklist.

Nothing, it is not possible to override a period block.

Manually release the ID address from the temporary blacklist.

Force a new IP address to the client.

Disconnect the client from the network.

True transparent proxy mode is best suited for use in which type of environment?

Flexible environments where you can easily change the IP addressing scheme

New networks where infrastructure is not yet defined

Flexible environments where you can easily change the IP addressing scheme

Small office to home office environments

Environments where you cannot change the IP addressing scheme

When is it possible to use a self-signed certificate, rather than one purchased from a commercial certificate authority?

If you are an enterprise whose computers all trust your active directory or other CA server

If you are a small business or home office

If you are an enterprise whose employees use only mobile devices

If you are an enterprise whose resources do not need security

If you are an enterprise whose computers all trust your active directory or other CA server

In which scenario might you want to use the compression feature on FortiWeb?

When you are serving many corporate road warriors using 4G tablets and phones

When you are offering a music streaming service

When you want to reduce buffering of video streams

Never, since most traffic today is already highly compressed

The FortiWeb machine learning (ML) feature is a two-phase analysis mechanism.Which two functions does the first layer perform? (Choose two.)

Builds a threat model behind every parameter and HTTP method

Determines whether traffic is an anomaly, based on observed application traffic over time

Determines whether an anomaly is a real attack or just a benign anomaly that should be ignored

Builds a threat model behind every parameter and HTTP method

Determines if a detected threat is a false-positive or not

Determines whether traffic is an anomaly, based on observed application traffic over time

Which three statements about HTTPS on FortiWeb are true? (Choose three.)

In true transparent mode, the TLS session terminator is a protected web server.

Enabling RC4 protects against the BEAST attack, but is not recommended if you configure FortiWeb to only offer TLS 1.2.

In transparent inspection mode, you select which certificate that FortiWeb will present in the server pool, not in the server policy.

For SNI, you select the certificate that FortiWeb will present in the server pool, not in the server policy.

After enabling HSTS, redirects to HTTPS are no longer necessary.

In true transparent mode, the TLS session terminator is a protected web server.

Enabling RC4 protects against the BEAST attack, but is not recommended if you configure FortiWeb to only offer TLS 1.2.

In transparent inspection mode, you select which certificate that FortiWeb will present in the server pool, not in the server policy.

What is one of the key benefits of the FortiGuard IP reputation feature?

It maintains a list of public IPs with a bad reputation for participating in attacks.

It maintains a list of private IP addresses.

It provides a document of IP addresses that are suspect, so that administrators can manually update their blacklists.

It maintains a list of public IPs with a bad reputation for participating in attacks.

How does FortiWeb protect against defacement attacks?

It keeps hashes of files and periodically compares them to the server.

It keeps a complete backup of all files and the database.

It keeps hashes of files and periodically compares them to the server.

It keeps full copies of all files and directories.

It keeps a live duplicate of the database.

You are using HTTP content routing on FortiWeb. You want requests for web application A to be forwarded to a cluster of web servers, which all host the same web application. You want requests for web application B to be forwarded to a different, single web server.Which statement about this solution is true?

Static or policy-based routes are not required.

The server policy applies the same protection profile to all of its protected web applications.

You must put the single web server in to a server pool, in order to use it with HTTP content routing.

You must chain policies so that requests for web application A go to the virtual server for policy A, and requests for web application B go to the virtual server for policy B.

Static or policy-based routes are not required.

When generating a protection configuration from an auto learning report what critical step must you do before generating the final protection configuration?

Drill down in the report to correct any false positives.

Restart the FortiWeb to clear the caches

Drill down in the report to correct any false positives.

Activate the report to create t profile

Take the FortiWeb offline to apply the profile

How does an ADOM differ from a VDOM?

ADOMs do not have virtual networking

ADOMs improve performance by offloading some functions.

ADOMs only affect specific functions, and do not provide full separation like VDOMs do.

Allows you to have 1 administrator for multiple tenants

What other consideration must you take into account when configuring Defacement protection

Use FortiWeb to block SQL Injections and keep regular backups of the Database

Also incorporate a FortiADC into your network

None. FortiWeb completely secures the site against defacement attacks

Configure the FortiGate to perform Anti-Defacement as well

Under what circumstances would you want to use the temporary uncompress feature of FortiWeb?

In the case of compression being done on the web server, to inspect the content of the compressed file.

In the case of compression being done on the FortiWeb, to inspect the content of the compressed file

In the case of the file being a .MP3 music file

In the case of compression being done on the web server, to inspect the content of the compressed file.

In the case of the file being an .MP4 video

Fortinet NSE6_FWB-6.4 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

Review the following configuration:

Fortinet NSE6_FWB-6.4 image Question 1 26833 09182024190643000000

What is the expected result of this configuration setting?

When machine learning (ML) is in its collecting phase, FortiWeb will accept an unlimited number of samples from the same source IP address.

When machine learning (ML) is in its running phase, FortiWeb will accept an unlimited number of samples from the same source IP address.

When machine learning (ML) is in its collecting phase, FortiWeb will not accept any samples from any source IP addresses.

When machine learning (ML) is in its running phase, FortiWeb will accept a set number of samples from the same source IP address.

Comment (0)

Fortinet NSE6_FWB-6.4 Practice Test 1

Question

Fortinet NSE6_FWB-6.4 Practice Tests

Practice Tests