Fortinet FCP_FWB_AD-7.4 Exam Questions Instant Access

Question 1

An administrator notices multiple IP addresses attempting to log in to an application frequently, within a short time period. They suspect attackers are attempting to guess user passwords for a secure application.

What is the best way to limit this type of attack on FortiWeb, while still allowing legitimate traffic through?

ABlocklist any suspected IPs.

BConfigure a brute force login custom policy.

CRate limit all connections from suspected IP addresses.

DBlock the IP address at the border router.

Answer : B

The best way to limit brute force login attacks on FortiWeb is to configure a brute force login custom policy. FortiWeb provides the ability to detect and mitigate brute force login attempts by automatically limiting the number of failed login attempts within a specific time period. This approach allows you to block or rate limit suspicious IP addresses while still allowing legitimate users access, based on your configuration.

Question 2

Refer to the exhibit.

Which statement is true?

AFortiWeb cannot perform content inspection on the traffic because it is encrypted.

BFortiWeb is decrypting and re-encrypting the traffic.

CThe server is not performing any cryptography on the traffic.

DThe server is encrypting traffic being sent to the client.

Answer : B

In the diagram, FortiWeb is positioned between the client and the server, handling encrypted HTTPS traffic from the client and sending unencrypted HTTP traffic to the server. This indicates that FortiWeb is performing SSL offloading, which means it is decrypting the HTTPS traffic from the client, inspecting it, and then re-encrypting the traffic before forwarding it to the server.

Question 3

What are two possible impacts of a DoS attack on your web server? (Choose two.)

AThe web application starts accepting unencrypted traffic.

BThe web application is unable to accept any more connections because of network socket exhaustion.

CThe web application server is unable to accept new client sessions due to memory exhaustion.

DThe web application server database is compromised with data theft.

Answer : B, C

The web application is unable to accept any more connections because of network socket exhaustion: A Denial of Service (DoS) attack often floods the web server with an overwhelming number of requests, leading to network socket exhaustion. This can prevent the server from accepting new legitimate connections, effectively disrupting service.

The web application server is unable to accept new client sessions due to memory exhaustion: DoS attacks can consume a significant amount of server memory, causing memory exhaustion. This results in the web application being unable to accept new client sessions or handle requests properly.

Question 4

Under which two circumstances does FortiWeb use its own certificates? (Choose two.)

AConnecting to browser clients using SSL

BMaking a secondary HTTPS connection to a server where FortiWeb acts as a client

CRouting an HTTPS connection to a FortiGate

DAn administrator session connecting to the GUI using HTTPS

Answer : B, D

Making a secondary HTTPS connection to a server where FortiWeb acts as a client: When FortiWeb needs to connect to an external server via HTTPS (acting as a client), it may use its own certificates for that connection.

An administrator session connecting to the GUI using HTTPS: FortiWeb uses its own certificates to secure the HTTPS connection between the administrator and the FortiWeb GUI. This ensures secure access for management purposes.

Question 5

What is the difference between an API gateway protection schema and a machine learning (ML) API protection schema?

AAn API gateway protection schema does not allow authentication.

BAn API gateway protection schema handles response bodies.

CAn API gateway protection schema supports data types other than string.

DAn API gateway protection schema cannot change without administrator intervention.

Answer : C

In FortiWeb's API protection mechanisms, there are distinctions between the traditional API gateway protection schema and the machine learning (ML) based API protection schema:

Data Type Support: The API gateway protection schema has the capability to support various data types beyond just strings, allowing for more comprehensive validation and enforcement of API schemas.

Schema Adaptability: The ML-based API protection schema is designed to automatically learn and adapt to changes in the API structure without requiring manual intervention from administrators. This dynamic learning process enables FortiWeb to identify and protect against anomalies and potential threats in real-time.

Question 6

How are bot machine learning (ML) models different from API or anomaly detection models?

ABot ML models analyze multiple connections overtime instead analyzing each connection as a single unit.

BBot ML models detect only anomalies and not actual threats.

CBot ML models inspect more types of connection properties.

DBot ML models do not update models periodically from new data.

Answer : A

Bot ML models analyze multiple connections over time instead of analyzing each connection as a single unit: This is the key distinction. Bot ML models focus on analyzing patterns over a period of time, looking at behavioral patterns across multiple requests or connections from the same source to identify potential bot activity. Unlike traditional anomaly detection or API models that may focus on single connections or individual transactions, bot detection typically examines aggregated behavior to identify patterns indicative of bots, such as high-frequency requests or unusual traffic flows.

Question 7

Refer to the exhibits.

What will happen when a client attempts a mousedown cross-site scripting (XSS) attack against the site http://my.blog.org/userl1/blog.php and FortiWeb is enforcing the highlighted signature?

AThe connection will be stripped of the mousedown JavaScript code.

BThe connection will be blocked as an XSS attack.

CFortiWeb will report the new mousedown attack to FortiGuard.

DThe connection will be allowed.

Answer : D

In the provided configuration, the signature exception has been set for the URL http://my.blog.org/user1V. This means that any request to this specific URL will bypass the signature ID 01000001, which is designed to block cross-site scripting (XSS) attacks using the mousedown event. As the request comes from the URL http://my.blog.org/userl1/blog.php, which does not match the exception rule for http://my.blog.org/user1V, the attack will be allowed through.

Therefore, the connection will be allowed because the exception rule bypasses protection for the specified URL.

Fortinet FCP - FortiWeb 7.4 Administrator FCP_FWB_AD-7.4 Exam Questions