NSE5_FWB_AD-8.0 Sample Questions Answers

The problem is not that the API key is invalid; the key belongs to a real user. The issue is authorization scope: group B is allowed only to access /api/v1/reports, but the request targets /api/v1/data. The correct FortiWeb control is API gateway rule enforcement using API key verification and API user grouping. FortiWeb can restrict API access by user group, sub-URL, API key verification, and configured violation actions. Blocking the endpoint for every group is too broad, moving the user to another group grants unnecessary privilege, and allowing all API keys to access all endpoints destroys endpoint-level authorization. The correct fix is group-based access control on /api/v1/data.

================

Automatic HTTP-to-HTTPS redirection should be enabled when users must be forced onto encrypted communication, especially for applications that process logins, credentials, payment data, personal data, or other sensitive information. HTTP sends traffic without transport encryption, which exposes users to interception, credential theft, session hijacking, and downgrade-style risk. FortiWeb can redirect HTTP requests to HTTPS so users who type or follow an insecure HTTP URL are automatically moved to the secure version of the application. Keeping both HTTP and HTTPS available for flexibility weakens security. Static sites without sensitive data may not require this control. A back-end server using only HTTP is a separate SSL offloading design issue and does not justify leaving client-side traffic unencrypted.

SSRF is an application-layer abuse case where attacker-controlled input causes the backend application to make unintended server-side requests. FortiWeb controls such as parameter validation, file security, and ML anomaly detection reduce risk, but SSRF often succeeds when the application accepts weakly validated URLs, hostnames, redirects, metadata endpoints, internal IP ranges, or backend-only resources. Disabling ML would weaken protection. Moving SSRF protection to FortiGate is wrong because SSRF depends on HTTP/API logic, not only network-layer filtering. HTTPS inspection alone does not solve unsafe backend request behavior. The correct priority is to refine input validation and filtering logic so FortiWeb can better detect and block malicious URL, parameter, and backend-request patterns.

================

When FortiWeb is deployed behind a load balancer or upstream proxy, it may see only the load balancer IP address as the source for every request. This causes poor client identification and can lead FortiWeb to block many legitimate users as if they are one abusive client. The correct fix is to preserve the original client IP address in an HTTP header, commonly using X-Forwarded-For or a similar trusted client-IP header. FortiWeb can then be configured to read that header for accurate client identification, logging, rate limiting, and IP-based security decisions. Bot detection, signature updates, and HTTPS caching do not solve the core source-IP visibility problem.

================

FortiAI improves investigation workflow by helping administrators interpret FortiWeb activity using natural language. Instead of manually reviewing many raw log entries, administrators can ask FortiAI questions about recent events, blocked requests, attack patterns, or policy behavior and receive a readable explanation. This helps reduce investigation time and makes troubleshooting faster, especially when reviewing attack logs, event logs, and traffic context. FortiAI does not disable logging; that would reduce visibility. It also does not replace FortiGuard updates, which remain important for signatures, reputation, and threat intelligence. Blocking malicious IP addresses automatically is a security action handled through FortiWeb policies and protections, not the primary FortiAI workflow benefit. The best answer is natural-language event explanation.

================

The exhibit shows the administrator account using IPv4 trusted hosts with a broad entry that effectively allows management access attempts from any IPv4 source. To reduce brute force exposure against the FortiWeb GUI, the administrator should restrict the trusted host entry to a specific trusted management IP address or subnet. FortiWeb administrator accounts can be limited by trusted host settings, so only defined source addresses can even attempt to authenticate. Changing the upstream device may help, but FortiWeb should still enforce its own management access restriction. Deleting the built-in administrator account does not solve the source-access problem. Changing the access profile to read-only only limits privileges after login; it does not prevent brute force attempts against the GUI.

================

A WAF such as FortiWeb is specifically built to protect web applications and web servers from HTTP and HTTPS application-layer attacks. SQL injection and cross-site scripting are Layer 7 threats that exploit web application input handling, not general network-layer forwarding. FortiWeb inspects HTTP/S requests, applies attack signatures, protocol validation, parameter validation, and other web protection controls to detect malicious payloads before they reach the protected application. Option A is wrong because protecting user browsers is mainly endpoint or client security, not WAF server-side protection. Option B is too generic and describes network firewall or IPS-style inspection rather than web application firewall enforcement. The two correct WAF actions are detecting Layer 7 attacks and analyzing HTTP/S requests targeting the web server.

================