問題1
A third-party penetration test reveals that users can bypass login controls through a mobile API.
Your current FortiWeb configuration includes zero trust network access (ZTNA) profiles and cookie security, but API protection and client management are not enabled. The security team asks you to recommend the most effective way to close this gap. Which FortiWeb adjustment would best prevent future unauthorized API access?
A third-party penetration test reveals that users can bypass login controls through a mobile API.
Your current FortiWeb configuration includes zero trust network access (ZTNA) profiles and cookie security, but API protection and client management are not enabled. The security team asks you to recommend the most effective way to close this gap. Which FortiWeb adjustment would best prevent future unauthorized API access?
正確答案: D
說明：（僅 NewDumps 成員可見）
問題2
A web application requires that FortiWeb detect and block credential stuffing attempts where a botnet cycles through many username/password combinations. Which FortiWeb feature is best suited for this?
A web application requires that FortiWeb detect and block credential stuffing attempts where a botnet cycles through many username/password combinations. Which FortiWeb feature is best suited for this?
正確答案: D
說明：（僅 NewDumps 成員可見）
問題3
Refer to the exhibit.
You are a FortiWeb administrator. FortiWeb is deployed between a FortiGate and two back-end web servers, as shown in the diagram. No server policies are currently configured on FortiWeb.
While testing, you notice that a student system in the 100.64.0.0/24 network is still able to access the back-end servers in 10.1.1.0/24, even though FortiWeb is not logging or inspecting the traffic.
Which action should you take to ensure FortiWeb blocks or inspects all traffic before it reaches the back-end servers?
Refer to the exhibit.
You are a FortiWeb administrator. FortiWeb is deployed between a FortiGate and two back-end web servers, as shown in the diagram. No server policies are currently configured on FortiWeb.
While testing, you notice that a student system in the 100.64.0.0/24 network is still able to access the back-end servers in 10.1.1.0/24, even though FortiWeb is not logging or inspecting the traffic.
Which action should you take to ensure FortiWeb blocks or inspects all traffic before it reaches the back-end servers?
正確答案: B
說明：（僅 NewDumps 成員可見）
問題4
An administrator sees repeated requests probing for common vulnerable file paths such as "/wp- admin/" and "/.env" against a server that does not run WordPress or expose environment files.
Which FortiWeb feature is designed to detect this behavior pattern?
An administrator sees repeated requests probing for common vulnerable file paths such as "/wp- admin/" and "/.env" against a server that does not run WordPress or expose environment files.
Which FortiWeb feature is designed to detect this behavior pattern?
正確答案: C
說明：（僅 NewDumps 成員可見）
問題5
Drag and Drop Question
A FortiWeb administrator is reviewing protection effectiveness after a surge in malicious traffic exposed design flaws and misconfigurations in several web applications.
For each Open Web Application Security Project (OWASP) risk listed, choose the FortiWeb feature that offers the most strategic protection, considering both coverage depth and operational effectiveness.
Match the most appropriate FortiWeb feature to each OWASP issue.
Select each FortiWeb feature in the left column, hold and drag it to the blank space next to the OWASP issue in the column on the right. Once you match a FortiWeb feature to the OWASP issue, you can move it again if you want to change your answer by clicking on the FortiWeb feature. You need to match five FortiWeb features to the OWASP issue in the work area.
Drag and Drop Question
A FortiWeb administrator is reviewing protection effectiveness after a surge in malicious traffic exposed design flaws and misconfigurations in several web applications.
For each Open Web Application Security Project (OWASP) risk listed, choose the FortiWeb feature that offers the most strategic protection, considering both coverage depth and operational effectiveness.
Match the most appropriate FortiWeb feature to each OWASP issue.
Select each FortiWeb feature in the left column, hold and drag it to the blank space next to the OWASP issue in the column on the right. Once you match a FortiWeb feature to the OWASP issue, you can move it again if you want to change your answer by clicking on the FortiWeb feature. You need to match five FortiWeb features to the OWASP issue in the work area.
正確答案:
Explanation:
A01: Broken Access Control → Site publish
A03: Injection → Parameter validation
A04: Insecure Design → Web vulnerability scan
A05: Security Misconfiguration → HSTS header
Site publish helps enforce controlled access to protected applications. Parameter validation restricts unsafe or unexpected input that could be used in injection attacks. Web vulnerability scanning helps identify application weaknesses and design-related exposure before attackers exploit them. HSTS reduces security misconfiguration risk by forcing browsers to use HTTPS for the protected site.
問題6
An administrator notices that legitimate search engine crawlers are being blocked by FortiWeb's bot mitigation feature. What is the recommended way to allow known, verified crawlers while still blocking malicious bots?
An administrator notices that legitimate search engine crawlers are being blocked by FortiWeb's bot mitigation feature. What is the recommended way to allow known, verified crawlers while still blocking malicious bots?
正確答案: A
說明：（僅 NewDumps 成員可見）
問題7
A FortiWeb administrator is hardening a customer checkout website.
The site contains sensitive links such as Login, Payment, and Admin, which are embedded in the HTML content of several pages.
A vulnerability scan shows that automated bots can crawl the web pages and easily enumerate these links by parsing the HTML source, even though users access them normally, through the site navigation.
Which FortiWeb feature should the administrator enable to prevent automated scanners from discovering these links?
A FortiWeb administrator is hardening a customer checkout website.
The site contains sensitive links such as Login, Payment, and Admin, which are embedded in the HTML content of several pages.
A vulnerability scan shows that automated bots can crawl the web pages and easily enumerate these links by parsing the HTML source, even though users access them normally, through the site navigation.
Which FortiWeb feature should the administrator enable to prevent automated scanners from discovering these links?
正確答案: C
說明：（僅 NewDumps 成員可見）