Free Sales Ending Soon - Use Real NSE5_FWB_AD-8.0 PDF Questions [Aug 28, 2026]
Updated Aug-2026 Exam NSE5_FWB_AD-8.0 Dumps - Pass Your Certification Exam
NEW QUESTION # 12
You have configured parameter validation, file security, and machine learning (ML) anomaly detection for a web form, but some server-side request forgery tests are still succeeding. You need to advise the team on what to prioritize next to improve SSRF protection without compromising other parts of the application.
Which recommendation would best strengthen FortiWeb's ability to block remaining SSRF attempts?
- A. Disable ML anomaly detection and rely solely on parameter inspection.
- B. Review and refine input validation logic, as SSRF may be exploiting backend behavior or bypassing weak filters.
- C. Offload all server-side request forgery (SSRF) protection to FortiGate and remove FortiWeb from the API flow.
- D. Apply HTTPS inspection at the transport layer, which FortiWeb does not use to block SSRF.
Answer: B
Explanation:
SSRF is an application-layer abuse case where attacker-controlled input causes the backend application to make unintended server-side requests. FortiWeb controls such as parameter validation, file security, and ML anomaly detection reduce risk, but SSRF often succeeds when the application accepts weakly validated URLs, hostnames, redirects, metadata endpoints, internal IP ranges, or backend-only resources. Disabling ML would weaken protection. Moving SSRF protection to FortiGate is wrong because SSRF depends on HTTP/API logic, not only network-layer filtering. HTTPS inspection alone does not solve unsafe backend request behavior. The correct priority is to refine input validation and filtering logic so FortiWeb can better detect and block malicious URL, parameter, and backend-request patterns.
NEW QUESTION # 13
A FortiWeb administrator is hardening a customer checkout website.
The site contains sensitive links such as Login, Payment, and Admin, which are embedded in the HTML content of several pages.
A vulnerability scan shows that automated bots can crawl the web pages and easily enumerate these links by parsing the HTML source, even though users access them normally, through the site navigation.
Which FortiWeb feature should the administrator enable to prevent automated scanners from discovering these links?
- A. URL encryption
- B. Deep packet inspection
- C. Link cloaking
- D. URL rewriting
Answer: C
Explanation:
Link cloaking is the FortiWeb feature designed to hide sensitive URLs or links from automated scanners and crawlers that parse HTML source code. In this scenario, the problem is not routing, encryption, or packet inspection; the problem is that bots can read embedded links directly from page content and enumerate sensitive paths such as Login, Payment, and Admin. Link cloaking helps obscure those links so that automated tools cannot easily discover them while normal users can still navigate the site as intended. URL rewriting changes URLs for routing or presentation, but it is not the most precise feature for hiding embedded links from scanners. Deep packet inspection is too broad and does not specifically solve HTML link enumeration.
NEW QUESTION # 14
Refer to the exhibit.
You are configuring SSL offloading on FortiWeb to protect a public-facing application. Clients connect using HTTPS, while FortiWeb forwards requests to the back-end server using HTTP.
You are reviewing certificate deployment and need to decide where to install the private key for the certificate used in client connections.
In this SSL offloading setup, which device is responsible for using the private key associated with the web server certificate?
- A. The client, because it initiates the TLS handshake and verifies the certificate.
- B. The server, because it always handles certificates regardless of SSL mode.
- C. None. SSL offloading does not require a private key because FortiWeb only forwards traffic.
- D. FortiWeb, because it terminates the HTTPS session and decrypts traffic.
Answer: D
Explanation:
In SSL offloading, FortiWeb is the TLS endpoint for client connections. The client negotiates HTTPS with FortiWeb, not directly with the back-end web server. Therefore, FortiWeb must have the website certificate and associated private key so it can complete the TLS handshake, decrypt inbound HTTPS traffic, inspect the HTTP content, and then forward the request to the server using HTTP or a separate back-end connection.
Option B is wrong because TLS termination requires the private key. Option C describes SSL inspection or direct server termination, not offloading. Option D is wrong because clients verify the certificate but do not possess or use the server's private key. FortiWeb owns the private-key function in this design.
NEW QUESTION # 15
A FortiWeb administrator is reviewing issues found during a security audit. The audit lists shortcomings based on behavior, configuration, and data protection.
The administrator must break down the findings and match them with the correct FortiWeb feature.
Select each FortiWeb feature in the left column, hold and drag it to the blank space next to the OWASP issue in the column on the right. Once you match a FortiWeb feature to the OWASP issue, you can move it again if you want to change your answer by clicking on the FortiWeb feature. You need to match five FortiWeb features to the OWASP issue in the work area.
Answer:
Explanation:
Explanation:
The mapping follows the security risk each FortiWeb feature mitigates. User Tracking maps to Broken Access Control because it helps enforce authenticated-session behavior and can prevent unauthorized access patterns.
HSTS Header Security maps to Cryptographic Failures because it forces browsers toward HTTPS and reduces downgrade or weak transport behavior. Padding Oracle Protection also maps to Cryptographic Failures because padding oracle attacks exploit weaknesses in encrypted session or token handling. Web Vulnerability Scan maps to Security Misconfiguration because scans help expose misconfigured, exposed, or vulnerable application components. Session Forwarding fits Insecure Design because it helps enforce expected application flow rather than allowing users or attackers to jump through weakly designed paths.
NEW QUESTION # 16
Refer to the exhibit.
There is only one administrator account configured on FortiWeb and IPv6 is not configured on any interface.
Which action should an administrator take to restrict any brute force attacks that attempt to gain access to the FortiWeb management GUI?
- A. Replace 0.0.0.0/0 with a specific IP address.
- B. Delete the built-in administrator user and create a new one.
- C. Make configuration changes on the upstream device.
- D. Change the setting in the Access Profile field to Read_Only .
Answer: A
Explanation:
The exhibit shows the administrator account using IPv4 trusted hosts with a broad entry that effectively allows management access attempts from any IPv4 source. To reduce brute force exposure against the FortiWeb GUI, the administrator should restrict the trusted host entry to a specific trusted management IP address or subnet. FortiWeb administrator accounts can be limited by trusted host settings, so only defined source addresses can even attempt to authenticate. Changing the upstream device may help, but FortiWeb should still enforce its own management access restriction. Deleting the built-in administrator account does not solve the source-access problem. Changing the access profile to read-only only limits privileges after login; it does not prevent brute force attempts against the GUI.
NEW QUESTION # 17
You are working on securing HTTPS communication across different services using FortiWeb. Your task is to configure and validate digital certificates for various traffic and communication needs.
Match each FortiWeb certificate feature to the certificate-related task that supports the feature.
Answer:
Explanation:
NEW QUESTION # 18
Which situation best explains when a FortiWeb administrator should enable automatic HTTP-to-HTTPS redirection?
- A. The web application handles logins or personal data and must ensure encrypted communication.
- B. The organization prefers to keep both HTTP and HTTPS available for flexibility.
- C. Users are accessing a static website that does not handle sensitive data.
- D. The back-end server uses only HTTP and cannot support encryption.
Answer: A
Explanation:
Automatic HTTP-to-HTTPS redirection should be enabled when users must be forced onto encrypted communication, especially for applications that process logins, credentials, payment data, personal data, or other sensitive information. HTTP sends traffic without transport encryption, which exposes users to interception, credential theft, session hijacking, and downgrade-style risk. FortiWeb can redirect HTTP requests to HTTPS so users who type or follow an insecure HTTP URL are automatically moved to the secure version of the application. Keeping both HTTP and HTTPS available for flexibility weakens security. Static sites without sensitive data may not require this control. A back-end server using only HTTP is a separate SSL offloading design issue and does not justify leaving client-side traffic unencrypted.
NEW QUESTION # 19
Refer to the exhibit.
You are a FortiWeb administrator reviewing how FortiAI protects sensitive data when interacting with a large language model (LLM).
Drag each label to the corresponding step in the FortiAI data privacy workflow.
Answer:
Explanation:
Explanation:
The FortiAI privacy workflow is designed to prevent sensitive local values from being exposed directly to the external LLM. First, the administrator submits a natural-language query. FortiWeb then masks sensitive data before the request leaves the local environment. The FortiAI Proxy sends the masked query to the LLM, allowing the LLM to process the intent without seeing the original confidential values. The LLM returns a function response rather than directly operating on sensitive production data. FortiWeb then unmasks the values and runs the query locally, keeping sensitive data under FortiWeb control. Finally, the administrator sees the result with the original values restored. This preserves usability while reducing data exposure risk.
NEW QUESTION # 20
A large enterprise has an existing web infrastructure with complex routing rules and static IP address assignments. The network administrators cannot modify the current IP address scheme, but they need FortiWeb to inspect and block threats like SQL injection and cross-site scripting (XSS) without changing the client-server communication flow.
In this situation, which FortiWeb operation mode is the most suitable?
- A. Web Cache Communication Protocol (WCCP) redirection mode
- B. Decryption mirror mode
- C. True transparent proxy mode
- D. Reverse proxy mode
Answer: C
Explanation:
True transparent proxy mode is the correct fit when the organization cannot change the current IP addressing or client-server communication flow. In this mode, FortiWeb is deployed transparently in the traffic path, usually using a Layer 2 bridge or v-zone, so clients still send traffic to the original web server IP address rather than to a FortiWeb virtual server IP. Unlike transparent inspection, true transparent proxy mode can more reliably block malicious traffic inline before forwarding it to the server. Reverse proxy mode normally requires clients or upstream devices to send traffic to FortiWeb's virtual server address. WCCP requires redirection design changes. Decryption mirror mode is mainly passive inspection and is not the best answer for inline blocking.
NEW QUESTION # 21
A large enterprise has an existing web infrastructure with complex routing rules and static IP address assignments. The network administrators cannot modify the current IP address scheme, but they need FortiWeb to inspect and block threats like SQL injection and cross-site scripting (XSS) without changing the client-server communication flow.
In this situation, which FortiWeb operation mode is the most suitable?
- A. Web Cache Communication Protocol (WCCP) redirection mode
- B. Decryption mirror mode
- C. True transparent proxy mode
- D. Reverse proxy mode
Answer: C
NEW QUESTION # 22
You need to monitor and respond to repeated suspicious activity from individual users who are accessing your web application.
Your goal is to evaluate each action the user takes and apply a response when their behavior becomes risky.
What can you configure on FortiWeb to track user behavior and respond automatically when risky activity continues?
- A. Set up scoring in the protection profile to track request behavior over time.
- B. Configure rate limiting on the IP reputation blocklist.
- C. Enable automatic cookie security under the server policy.
- D. Add a custom signature to block suspicious URLs immediately.
Answer: A
Explanation:
The requirement is to track user behavior over time and respond when cumulative activity becomes risky.
FortiWeb client management and threat scoring are built for that purpose. When enabled in the protection profile, FortiWeb can associate activity with a client, assign threat weights to suspicious behavior, and apply actions such as alerting, denying, or period blocking after a defined score threshold is exceeded. Rate limiting is useful for traffic volume, but it does not evaluate a user's full behavior pattern. A custom signature blocks a specific pattern immediately, not cumulative behavior. Cookie security protects session cookies but does not calculate behavioral risk. The correct configuration is scoring in the protection profile to track and respond to repeated risky actions.
NEW QUESTION # 23
A FortiWeb administrator is deciding between using SAML SSO or HTML authentication. They want to minimize the number of credential prompts users receive across multiple Fortinet services.
Which statement accurately describes which option is best, and why?
- A. SAML, because it blocks users from accessing anything not approved in FortiWeb policy.
- B. HTML form authentication, because it's faster and doesn't need external systems.
- C. SAML SSO, because it supports identity authentication on Fortinet devices.
- D. HTML form, because it provides token-based access to remote services.
Answer: C
Explanation:
SAML SSO is the correct choice when the goal is to reduce repeated credential prompts across multiple services. SAML uses a federated identity model, where users authenticate through an identity provider and then use assertions to access service providers without repeatedly entering credentials. This is exactly the value of single sign-on. HTML form authentication is more local and application-specific; it can authenticate users to a protected site, but it does not provide the same cross-service identity federation. Option B overstates SAML as a policy-blocking mechanism. Option C may be simpler but does not meet the SSO requirement.
Option D incorrectly describes HTML form authentication as token-based remote-service access.
NEW QUESTION # 24
You are reviewing SSL-related issues on FortiWeb. An administrator reports that they receive a certificate warning when they access the FortiWeb GUI over HTTPS. Separately, your FortiWeb device also makes outbound HTTPS requests to a back-end API server.
In which two situations would FortiWeb use its own certificates to establish or secure the connection?
(Choose two.)
- A. When FortiWeb connects to a back-end server over HTTPS as a client.
- B. When a client browser initiates an SSL session and FortiWeb is in transparent inspection mode.
- C. When an administrator connects to the FortiWeb GUI using HTTPS in a browser.
- D. When FortiWeb is routing an HTTPS connection to a FortiGate without decrypting it.
Answer: A,C
Explanation:
The correct answers are C and D. FortiWeb uses its own built-in/self-signed or configured server certificate when an administrator connects to the FortiWeb GUI over HTTPS. FortiWeb can also authenticate as a client when it connects to protected back-end servers over HTTPS, and it may present its own certificate for client PKI authentication. Option A is wrong because transparent inspection mode does not make FortiWeb the SSL endpoint in the same way; it inspects traffic without acting as the primary TLS termination point. Option B is also wrong because simply routing HTTPS without decryption does not require FortiWeb to present its own certificate. FortiWeb certificates matter when FortiWeb is an HTTPS endpoint or an authenticated HTTPS client.
NEW QUESTION # 25
A FortiWeb administrator is deciding between using SAML SSO or HTML authentication. They want to minimize the number of credential prompts users receive across multiple Fortinet services.
Which statement accurately describes which option is best, and why?
- A. SAML, because it blocks users from accessing anything not approved in FortiWeb policy.
- B. HTML form authentication, because it's faster and doesn't need external systems.
- C. SAML SSO, because it supports identity authentication on Fortinet devices.
- D. HTML form, because it provides token-based access to remote services.
Answer: C
NEW QUESTION # 26
You recently deployed two FortiWeb devices in an active-active (A-A) high availability (HA) cluster.
During routine maintenance, you want to confirm that the cluster is synchronizing the correct configuration areas and that both FortiWeb devices behave consistently in production.
As the FortiWeb administrator, which two configuration areas should you examine to verify that HA synchronization is functioning correctly? (Choose two.)
- A. Check the network configuration on both FortiWeb devices-such as interfaces and static routes-to ensure they are aligned.
- B. Review inspection and mitigation log files to determine if they are being replicated across both FortiWeb devices.
- C. Review policy configurations, including server policies and protection profiles, to confirm they match across the cluster.
- D. Verify whether firmware images and upgrade history are synchronized between the FortiWeb devices.
Answer: A,C
Explanation:
To validate HA synchronization, the administrator should compare the configuration areas that affect traffic handling and security enforcement. Network configuration, such as interface and routing alignment, is important because HA peers must process traffic consistently. Policy configuration is also critical because server policies, protection profiles, rules, and related web security settings determine how FortiWeb inspects and blocks requests. Logs are not the right synchronization target for this question; log files are used for investigation, not for proving configuration synchronization. Firmware images and upgrade history are also not the normal operational configuration areas used to verify HA policy behavior. The correct verification focus is network configuration consistency and web protection/server policy consistency across the HA cluster.
NEW QUESTION # 27
......
NSE5_FWB_AD-8.0 Dumps To Pass NSE 5 Network Security Analyst Exam in One Day: https://www.pdfdumps.com/NSE5_FWB_AD-8.0-valid-exam.html