Free FCP_FWB_AD-7.4: FCP - FortiWeb 7.4 Administrator Exam Questions and Answers

An administrator needs to find which signature matched a request that FortiWeb blocked, and the part of the request that triggered it. Which log type contains this information?

• AA. Event log
• BB. Traffic log
• CC. Debug log
• DD. Attack log

Which FortiWeb feature detects a client that has modified the value of a cookie issued by the protected application?

• AA. Page Access Rule
• BB. Parameter Validation Rule
• CC. Cookie Security policy
• DD. Hidden Fields Protection

Refer to the exhibit. Exhibit: JSON schema uploaded to a FortiWeb JSON protection rule { "type": "object", "properties": { "id": { "type": "integer", "minimum": 1 }, "qty": { "type": "integer", "minimum": 1, "maximum": 100 } }, "required": ["id", "qty"], "additionalProperties": false } The rule action is Alert & Deny. Which request body does FortiWeb block?

• AA. {"id": 2500, "qty": 1}
• BB. {"qty": 25, "id": 88}
• CC. {"id": 1, "qty": 100}
• DD. {"id": 18, "qty": 101}

A server policy uses ML anomaly detection with the action set to Alert & Deny. After the training period, the web team releases a redesign that changes the URL structure and the parameters of most forms. FortiWeb now flags most legitimate requests as anomalies. What should the administrator do?

• AA. Add the internal client addresses to a trusted IP policy
• BB. Move the server policy to Offline Protection mode
• CC. Delete the existing model and let FortiWeb collect new samples from the redesigned application
• DD. Set the anomaly detection action to Alert so flagged requests are no longer blocked

A company publishes a REST API for its order system behind FortiWeb. The developers supply an OpenAPI 3.0 document that lists every valid path, method and parameter. The security team requires that any request using an undefined path, an unlisted method or an undeclared parameter be rejected from the first request, with no learning period. Which configuration meets the requirement?

• AA. Upload the document as an OpenAPI validation file and enable OpenAPI validation in the web protection profile
• BB. Enable ML API protection on the server policy and let FortiWeb learn the API from live client requests
• CC. Upload the document as a JSON schema and apply it with a JSON protection rule in the web protection profile
• DD. Create an Allow URL access rule for every path in the specification and enable the rule in the web protection profile

A bank wants FortiWeb to detect and log attacks against its customer portal. The network team sets these conditions: no new device may sit in the production traffic path, no IP addressing or routing may change, and a switch port that mirrors portal traffic is available. Blocking is not required. Which deployment mode meets the conditions?

• AA. True transparent proxy
• BB. Transparent inspection
• CC. Offline protection
• DD. Reverse proxy

Which two statements about FortiWeb ML anomaly detection are true? (Choose two.)

Select 2 answers.

• AA. It uses a hidden Markov model to evaluate parameter values
• BB. It requires FortiGuard model updates before sample collection can start
• CC. It classifies each parameter value with a support vector machine
• DD. It learns normal behavior from live traffic instead of predefined signatures

A single FortiWeb server policy uses one virtual server IP address on port 443 to protect shop.example.com and blog.example.com. Each site has its own certificate from a public CA. Clients must see the correct certificate for the site they request. What should the administrator configure?

• AA. Add a second HTTPS service on port 8443 and bind the second certificate to it
• BB. Import both certificates and bind them to the HTTPS service as a certificate chain
• CC. Enable multi-certificate support and add an SNI entry for each host name
• DD. Create two server policies that share the same virtual server and the same HTTPS service port

A company wants to evaluate FortiWeb for two weeks. A switch SPAN port will mirror web traffic to a FortiWeb port, and the security team will review alerts only. The production traffic path must not change, and FortiWeb must not be able to block or modify any traffic. Which operation mode meets these requirements?

• AA. Transparent inspection
• BB. Offline protection
• CC. True transparent proxy
• DD. Reverse proxy

A server policy uses a protected host names group that lists www.example.com and shop.example.com. The Default Action of the group is set to Alert & Deny. A client sends a request to the virtual server IP address with the header Host: api.example.com. What is the result?

• AA. FortiWeb forwards the request to the first member of the server pool
• BB. FortiWeb blocks the request and generates a log message
• CC. FortiWeb forwards the request to the server pool and only logs an alert
• DD. FortiWeb redirects the request to the first host name in the group