Fortinet NSE5_FWB_AD-8.0 Fortinet NSE 5 - FortiWeb 8.0 Administrator Exam Practice Test

The exhibit shows the administrator account using IPv4 trusted hosts with a broad entry that effectively allows management access attempts from any IPv4 source. To reduce brute force exposure against the FortiWeb GUI, the administrator should restrict the trusted host entry to a specific trusted management IP address or subnet. FortiWeb administrator accounts can be limited by trusted host settings, so only defined source addresses can even attempt to authenticate. Changing the upstream device may help, but FortiWeb should still enforce its own management access restriction. Deleting the built-in administrator account does not solve the source-access problem. Changing the access profile to read-only only limits privileges after login; it does not prevent brute force attempts against the GUI.

================

The problem is not that the API key is invalid; the key belongs to a real user. The issue is authorization scope: group B is allowed only to access /api/v1/reports, but the request targets /api/v1/data. The correct FortiWeb control is API gateway rule enforcement using API key verification and API user grouping. FortiWeb can restrict API access by user group, sub-URL, API key verification, and configured violation actions. Blocking the endpoint for every group is too broad, moving the user to another group grants unnecessary privilege, and allowing all API keys to access all endpoints destroys endpoint-level authorization. The correct fix is group-based access control on /api/v1/data.

================

The ABP workflow begins when FortiWeb challenges the browser by injecting JavaScript used to collect behavior data. The client browser then executes that JavaScript and sends the observed behavior information to the ABP service. FortiWeb then uses the ABP service decision process to determine whether the browser behavior looks human or automated. If the ABP service identifies the activity as malicious or bot-like, FortiWeb blocks the request before it reaches the protected application. If the request is validated as coming from a real user, FortiWeb allows the traffic to continue to the back-end server. The order is important because FortiWeb cannot allow or block based on ABP until browser behavior has first been collected and evaluated.

================

The FortiGate is acting as an upstream reverse proxy, so FortiWeb sees the FortiGate address as the direct source IP unless it is configured to read the original client IP from the inserted HTTP header. Since FortiGate already inserts X-Forwarded-For, the proper fix is to modify the FortiWeb protection profile or related client-IP configuration so FortiWeb uses that header for client IP detection. This restores accurate logging, rate limiting, reputation checks, and IP-based enforcement. Changing to one-arm proxy is unnecessary and disruptive. Disabling IP-based detection weakens protection instead of fixing attribution. Recreating the policy with a predefined profile does not address the missing client IP mapping. The correct adjustment is to trust and use X-Forwarded-For.

The goal is to detect bots that avoid normal human interaction, specifically mouse use and clicking, while logging the event and treating it as high severity. In FortiWeb biometrics-based bot detection, monitored client events such as mouse movement, click, keyboard, screen touch, page focus, and scroll help FortiWeb distinguish human behavior from automated behavior. Since the question specifically mentions mouse and clicking, the correct monitored events are Mouse Movement and Click . The current action is Deny (no log) , which would not meet the logging requirement. Changing the action to Alert logs the event instead of silently denying it, and setting severity to High aligns with the requirement for a high-severity alert.

================

The scenario describes distributed scraping where each individual IP stays below request-rate thresholds. A simple DoS threshold is weak here because the attacker avoids volume-based detection per source. Static blocklists are also ineffective because many botnet IPs may appear only once or rotate frequently. Blocking every non-allowlisted user agent would cause severe false positives and is easy for bots to evade by spoofing headers. FortiWeb bot mitigation is the correct control because it can evaluate behavior beyond source IP volume. Device fingerprinting, browser behavior, headers, JavaScript challenges, and client characteristics help correlate suspicious automation even when requests are spread across many addresses. Therefore, bot mitigation with behavioral/device fingerprinting is the strongest answer.

================

When multiple HTTPS applications share one public IP address, the client begins the TLS connection and includes the requested hostname in the SNI field. FortiWeb uses SNI-based certificate selection to choose the appropriate certificate for that hostname. After presenting the correct certificate and completing the TLS handshake, FortiWeb decrypts the HTTPS session so it can inspect HTTP content. Content inspection then evaluates the host header and URL path, which are needed for application-aware routing decisions. Finally, intelligent traffic routing forwards the request to the correct back-end server or server pool. The sequence matters: FortiWeb cannot inspect the host and URL path or route by content until the HTTPS session is terminated and decrypted.

SAML SSO is the correct choice when the goal is to reduce repeated credential prompts across multiple services. SAML uses a federated identity model, where users authenticate through an identity provider and then use assertions to access service providers without repeatedly entering credentials. This is exactly the value of single sign-on. HTML form authentication is more local and application-specific; it can authenticate users to a protected site, but it does not provide the same cross-service identity federation. Option B overstates SAML as a policy-blocking mechanism. Option C may be simpler but does not meet the SSO requirement. Option D incorrectly describes HTML form authentication as token-based remote-service access.

================

FortiWeb machine learning uses layered detection rather than treating every unusual value as malicious. The HMM layer models normal parameter behavior and can flag a value as abnormal when it falls outside the learned distribution. However, abnormal does not automatically mean hostile. FortiWeb then uses additional ML classification logic, including SVM-based evaluation, to determine whether the anomaly resembles an actual attack or simply a legitimate unusual input. In this case, HMM noticed that the value was uncommon, but SVM classified it as normal, so FortiWeb allowed the request. That is expected behavior. Raising thresholds, disabling models, or assuming FortiWeb failed would misunderstand the two-stage ML decision process.

================

To validate HA synchronization, the administrator should compare the configuration areas that affect traffic handling and security enforcement. Network configuration, such as interface and routing alignment, is important because HA peers must process traffic consistently. Policy configuration is also critical because server policies, protection profiles, rules, and related web security settings determine how FortiWeb inspects and blocks requests. Logs are not the right synchronization target for this question; log files are used for investigation, not for proving configuration synchronization. Firmware images and upgrade history are also not the normal operational configuration areas used to verify HA policy behavior. The correct verification focus is network configuration consistency and web protection/server policy consistency across the HA cluster.

================