Free FCP-FWB-AD-7-4 sample questions

Correct answer: Identify the flagged events in the logs and add the corresponding user traffic to the ML exception list.

The most appropriate action is to create exceptions for the specific, legitimate traffic that is being misidentified. FortiWeb's ML allows administrators to review detected anomalies and mark them as false positives, effectively training the model to ignore similar legitimate patterns in the future. This refines the model's accuracy without disabling it or lowering its overall sensitivity, which would expose the application to other threats.

Correct answers: Create a CORS protection rule that specifies `https://shop.example.com` in the 'Allowed Origins' list.; Add `X-Auth-Token` to the 'Allowed Headers' list in the CORS protection rule.

The primary step in configuring CORS is to explicitly whitelist the origin from which the cross-domain requests are allowed. In this case, the front-end application's domain must be added to the 'Allowed Origins' list.

Because the request includes a custom header (`X-Auth-Token`), this header must be explicitly listed in the 'Allowed Headers' section of the CORS rule. Without this, the browser's preflight `OPTIONS` request will fail, blocking the actual `POST` request.

Correct answer: ML-based API Protection with continuous learning.

ML-based API Protection with continuous learning is the ideal solution for dynamic API environments. It analyzes live traffic to automatically discover and model the API structure, including endpoints and parameters. The continuous adjustment feature (new in 7.4) allows the model to adapt to frequent changes from a CI/CD pipeline without manual intervention, providing protection even without a static schema.

Correct answer: False

This statement is false. Layer 7 content rewriting, such as modifying HTTP headers or rewriting content in the body, requires FortiWeb to act as a full proxy that terminates the connection. This functionality is available in Reverse Proxy mode, typically with SSL offloading, but not in True Transparent Proxy mode, which operates at a lower level to inspect traffic without terminating the session.

Correct answer: ML-based Bot Detection with biometric modeling.

ML-based Bot Detection using biometric modeling is specifically designed to counter sophisticated bots that mimic human behavior. It analyzes subtle patterns like mouse movements, typing speed, and mobile device orientation (part of the 13 behavioral dimensions) to create a model of genuine human interaction. This allows it to distinguish advanced bots from real users, which simpler methods like rate limiting or signature matching cannot do.

Correct answer: Forwarding logs to a remote FortiAnalyzer and enabling log file hashing.

PCI DSS requires logs to be stored securely and their integrity to be protected. Forwarding logs to a remote, centralized logging server like FortiAnalyzer prevents an attacker from altering logs on the local FortiWeb device. Enabling log file hashing (or digital signing) on the FortiAnalyzer provides a cryptographic mechanism to verify that the logs have not been tampered with, directly addressing the log integrity requirement.

Correct answer: Enable the 'Add X-Forwarded-For Header' option in the server policy.

In Reverse Proxy mode, FortiWeb terminates the client connection and initiates a new one to the back-end server, which causes the source IP to be that of the FortiWeb. The standard method to preserve the original client IP is to enable the 'Add X-Forwarded-For Header' (or similar headers like X-Real-IP). This inserts an HTTP header containing the original client's IP address into the request sent to the back-end server. The web server must then be configured to log this header value.

Correct answer: Query complexity analysis within the GraphQL protection profile.

FortiWeb 7.4.1 introduced specific protections for GraphQL, including query complexity analysis. This feature allows administrators to set limits on factors like query depth and the number of aliases. By enforcing these limits, FortiWeb can block overly complex queries designed to overwhelm the server, effectively mitigating this type of denial-of-service attack vector unique to GraphQL.

Correct answer: SSL Offloading with the 'SSL/TLS mode' set to 'HTTPS'.

This scenario requires end-to-end encryption with inspection in the middle. This is achieved through SSL Offloading where FortiWeb terminates the client's SSL connection, inspects the decrypted traffic, and then re-encrypts it before sending it to the back-end server. Setting the 'SSL/TLS mode' to 'HTTPS' in the server pool configuration ensures that the connection from FortiWeb to the back-end servers is also encrypted.

Correct answer: To monitor the health of the peer device and trigger a failover if it becomes unresponsive.

The HA heartbeat interface is a dedicated link used by the cluster members to send keep-alive packets to each other. Its primary purpose is to monitor the status and health of the other device in the cluster. If the active unit stops receiving heartbeat packets from the passive unit (or vice-versa), it assumes the peer is down and triggers a failover process to maintain service availability.