Free FCP_FWB_AD-7.4: FCP - FortiWeb 7.4 Administrator Exam Questions and Answers

Last updated: September 19, 2026

Provider

Fortinet

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Practice format

Multiple choice

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   Which is an example of a cross-site scripting (XSS) attack?

   • A. SELECT username FROM accounts WHERE username='admin';-- ' AND password='password';
   • B. <img src="http://badfile/nothere" onerror=alert(document.cookie);>
   • C. SELECT username FROM accounts WHERE username='XSS' ' AND password='alert("http://badurl.com")';
   • D. <IMG SRC="xss.png">
   Reveal Answer

2. Question #2

   Which two statements about running a vulnerability scan are true? (Choose two.)

   Select 2 answers.

   • A. You should run the vulnerability scan during a maintenance window.
   • B. You should run the vulnerability scan multiple times so it can automatically update the scan parameters.
   • C. You should run the vulnerability scan in a test environment.
   • D. You should run the vulnerability scan on the live website to get accurate results.
   Reveal Answer

3. Question #3

   Refer to the exhibit. Attack ID20000010is brute force logins. Which statement is accurate about the potential attack?

   
   • A. The attacker has successfully retrieved the credentials to www.example.com.
   • B. www.example.com is running attacks against the client 192.168.1.11.
   • C. The attack has happened 10 times.
   • D. 192.168.1.11 is sending suspicious traffic to FortiWeb.
   Reveal Answer

4. Question #4

   Refer to the exhibit. What is true about this FortiWeb device? (Choose two.)

   

   Select 2 answers.

   • A. It has 41% of the disk available for logging.
   • B. It was upgraded to a different version after initial installation.
   • C. It is currently running version 6.4.0.
   • D. It is currently running version 6.4.1.
   Reveal Answer

5. Question #5

   Which two items can be defined in a FortiWeb XML Protection Rule? (Choose two.)

   Select 2 answers.

   • A. API key
   • B. IXML Schema
   • C. Web protection profile
   • D. Request URL
   Reveal Answer

6. Question #6

   Which implementation is most suited for a deployment that must meet PCI DSS compliance criteria?

   • A. SSL offloading with FortiWeb in reverse proxy mode
   • B. SSL offloading with FortiWeb in PCI DSS mode
   • C. SSL offloading with FortiWeb in transparency mode
   • D. SSL offloading with FortiWeb in full transparent proxy mode
   Reveal Answer

7. Question #7

   A customer wants to be able to index your websites for search and advertisement purposes. What is the easiest way to allow this on a FortiWeb?

   • A. Add the indexer IP address to the trusted IP list on the FortiWeb.
   • B. Add the indexer IP address to the FortiGuard "Known Search Engines" category.
   • C. Create a firewall rule to bypass the FortiWeb entirely for the indexer IP address.
   • D. Do not allow any external sites to index your websites.
   Reveal Answer

8. Question #8

   What are two results of enabling monitor mode on FortiWeb? (Choose two.)

   Select 2 answers.

   • A. It does not affect denial-of-service (DoS) protection profile actions to rate limit traffic.
   • B. It uses the default action for all profiles and, depending on the configuration, blocks or allows traffic.
   • C. It does not affect any HTML rewriting or redirection actions in web protection profiles.
   • D. It overrides all usual profile action
   • E. FortiWeb accepts all requests and generates alert email or log messages only for violations.
   Reveal Answer

9. Question #9

   Which would be a reason to implement HTTP rewriting?

   • A. To redirect HTTP to HTTPS.
   • B. To implement load balancing.
   • C. To replace a vulnerable element in a requested URL.
   • D. The original page has moved to a new URL.
   Reveal Answer

10. Question #10

    An administrator notices multiple IP addresses attempting to log in to an application frequently, within a short time period. They suspect attackers are attempting to guess user passwords for a secure application. What is the best way to limit this type of attack on FortiWeb, while still allowing legitimate traffic through?

    • A. Blocklist any suspected IPs.
    • B. Configure a brute force login custom policy.
    • C. Rate limit all connections from suspected IP addresses.
    • D. Block the IP address at the border router.
    Reveal Answer