Free FCP-FWB-AD-7-4 sample questions

Correct answer: ML-based API Protection with continuous learning.

ML-based API Protection with continuous learning is the ideal solution for dynamic API environments. It analyzes live traffic to automatically discover and model the API structure, including endpoints and parameters. The continuous adjustment feature (new in 7.4) allows the model to adapt to frequent changes from a CI/CD pipeline without manual intervention, providing protection even without a static schema.

Correct answer: False

This statement is false. Layer 7 content rewriting, such as modifying HTTP headers or rewriting content in the body, requires FortiWeb to act as a full proxy that terminates the connection. This functionality is available in Reverse Proxy mode, typically with SSL offloading, but not in True Transparent Proxy mode, which operates at a lower level to inspect traffic without terminating the session.

Correct answer: ML-based Bot Detection with biometric modeling.

ML-based Bot Detection using biometric modeling is specifically designed to counter sophisticated bots that mimic human behavior. It analyzes subtle patterns like mouse movements, typing speed, and mobile device orientation (part of the 13 behavioral dimensions) to create a model of genuine human interaction. This allows it to distinguish advanced bots from real users, which simpler methods like rate limiting or signature matching cannot do.

Correct answer: Forwarding logs to a remote FortiAnalyzer and enabling log file hashing.

PCI DSS requires logs to be stored securely and their integrity to be protected. Forwarding logs to a remote, centralized logging server like FortiAnalyzer prevents an attacker from altering logs on the local FortiWeb device. Enabling log file hashing (or digital signing) on the FortiAnalyzer provides a cryptographic mechanism to verify that the logs have not been tampered with, directly addressing the log integrity requirement.

Correct answer: Enable the 'Add X-Forwarded-For Header' option in the server policy.

In Reverse Proxy mode, FortiWeb terminates the client connection and initiates a new one to the back-end server, which causes the source IP to be that of the FortiWeb. The standard method to preserve the original client IP is to enable the 'Add X-Forwarded-For Header' (or similar headers like X-Real-IP). This inserts an HTTP header containing the original client's IP address into the request sent to the back-end server. The web server must then be configured to log this header value.

Correct answer: Query complexity analysis within the GraphQL protection profile.

FortiWeb 7.4.1 introduced specific protections for GraphQL, including query complexity analysis. This feature allows administrators to set limits on factors like query depth and the number of aliases. By enforcing these limits, FortiWeb can block overly complex queries designed to overwhelm the server, effectively mitigating this type of denial-of-service attack vector unique to GraphQL.

Correct answer: SSL Offloading with the 'SSL/TLS mode' set to 'HTTPS'.

This scenario requires end-to-end encryption with inspection in the middle. This is achieved through SSL Offloading where FortiWeb terminates the client's SSL connection, inspects the decrypted traffic, and then re-encrypts it before sending it to the back-end server. Setting the 'SSL/TLS mode' to 'HTTPS' in the server pool configuration ensures that the connection from FortiWeb to the back-end servers is also encrypted.

Correct answer: To monitor the health of the peer device and trigger a failover if it becomes unresponsive.

The HA heartbeat interface is a dedicated link used by the cluster members to send keep-alive packets to each other. Its primary purpose is to monitor the status and health of the other device in the cluster. If the active unit stops receiving heartbeat packets from the passive unit (or vice-versa), it assumes the peer is down and triggers a failover process to maintain service availability.

Correct answer: Create a custom signature that uses a regular expression to match the specific exploit pattern in the URL query string, set the action to 'Alert & Deny', and apply it to the relevant server policy.

This is the best approach for virtual patching a specific zero-day vulnerability. Creating a custom signature with a precise regular expression allows the security team to target the exact exploit pattern. This minimizes the risk of false positives that could be caused by enabling broad signature categories. Setting the action to 'Alert & Deny' meets both requirements: it blocks the attack and immediately notifies the security team. This is a targeted, surgical approach ideal for zero-day mitigation.

Correct answers: Least Connections; Weighted Round Robin

The 'Least Connections' algorithm directs new connections to the server with the fewest active connections, which is useful for balancing load on servers with varying capacity.

'Weighted Round Robin' is a common algorithm that distributes connections sequentially among servers but allows an administrator to assign a weight to each server, sending more traffic to servers with higher capacity.