Real NSE5_FWB_AD-8.0 Exam Questions are the Best Preparation Material [Q16-Q30]

Rate this post

Real NSE5_FWB_AD-8.0 Exam Questions are the Best Preparation Material

Practice on 2026 LATEST NSE5_FWB_AD-8.0 Exam Updated 38 Questions

Q16. You are reviewing the FortiWeb integration with the Advanced Bot Protection (ABP) service.
Match each step in the ABP flow with its description.

Q17. Refer to the exhibit.

There is only one administrator account configured on FortiWeb and IPv6 is not configured on any interface.
Which action should an administrator take to restrict any brute force attacks that attempt to gain access to the FortiWeb management GUI?

Make configuration changes on the upstream device.

Replace 0.0.0.0/0 with a specific IP address.

Delete the built-in administrator user and create a new one.

Change the setting in the Access Profile field to Read_Only .

Q18. FortiWeb is blocking groups of users behind your load balancer. In the logs, all users show the same source IP address.
Which action should you take to restore proper client identification?

Add a bot detection rule in the protection profile.

Update the signature engine.

Reconfigure the load balancer to insert the original client IP address in an HTTP header.

Enable caching for HTTPS traffic.

Q19. While reviewing FortiWeb logs, you notice a suspicious login request that failed authentication. You suspect it may be part of an injection attack targeting the login form.
Which input pattern is an example of a typical SQL injection attempt that could bypass authentication checks?

‘||(SELECT password FROM users WHERE role=’admin’)||’

< sql > select(ALL USERS); < /sql >

< script > document.location=’/steal?cookie=’+document.cookie < /script >

SELECT username FROM accounts WHERE username=’admin’;– ‘ AND password=’password’;

Q20. You need to monitor and respond to repeated suspicious activity from individual users who are accessing your web application.
Your goal is to evaluate each action the user takes and apply a response when their behavior becomes risky.
What can you configure on FortiWeb to track user behavior and respond automatically when risky activity continues?

Configure rate limiting on the IP reputation blocklist.

Add a custom signature to block suspicious URLs immediately.

Enable automatic cookie security under the server policy.

Set up scoring in the protection profile to track request behavior over time.

Q21. Refer to the exhibit.

A FortiWeb administrator tests a new form input value after training the machine learning (ML) anomaly detection system.
The hidden Markov model (HMM) flags the input as abnormal, while the support vector machine (SVM) model classifies it as normal. FortiWeb allows the request.
What does this result indicate about the FortiWeb ML anomaly detection behavior?

The anomaly detection thresholds are too low and must be increased.

One of the ML models should be disabled to avoid inconsistent results.

FortiWeb is correctly allowing an unusual but non-malicious input based on combined HMM and SVM evaluation.

FortiWeb failed to detect an attack and should have blocked the request.

Q22. A third-party penetration test reveals that users can bypass login controls through a mobile API. Your current FortiWeb configuration includes zero trust network access (ZTNA) profiles and cookie security, but API protection and client management are not enabled. The security team asks you to recommend the most effective way to close this gap.
Which FortiWeb adjustment would best prevent future unauthorized API access?

Switch to a reverse-proxy mode to bypass cookie-based controls.

Enable API protection and client management to enforce identity checks on mobile API traffic.

Replace ZTNA with bot protection to reduce false positives.

Log only API traffic and rely on FortiAnalyzer for future alerts.

Q23. You are hosting multiple secure web applications behind a single public IP address on FortiWeb.
When a client connects to a service, FortiWeb needs to:
* Identify the correct SSL certificate.
* Decrypt the request.
* Route the request to the correct back-end server.
Match each FortiWeb function to the request handling step that performs the function.

Q24. You are a FortiWeb administrator investigating an SQL injection attack on your company’s customer portal.
The network firewall and intrusion prevention system (IPS) did not stop the attack.
You decide to deploy a web application firewall (WAF) to help prevent this type of attack.
Which two actions can you take to block application-layer threats? (Choose two.)

Focus on client-side risks, such as protecting user browsers.

Inspect general network traffic equally between clients and servers.

Detect and block threats like SQL injection, cross-site scripting (XSS), and other Layer 7 attacks.

Filter and analyze HTTP/S requests to block attacks targeting the web server.

Q25. You are configuring the FortiWeb client-side protection feature to defend against browser-based attacks.
Based on the layered defense strategy, drag and drop each control to the corresponding stage of defense.

Q26. Which URL should you rewrite to reduce security risk?

https://www.example.com/about/team

https://www.example.com/wordpress/?feed=rss2

https://www.example.com/products/today

https://www.example.com/25.3.6/Browse/MediaData

Q27. You recently deployed two FortiWeb devices in an active-active (A-A) high availability (HA) cluster.
During routine maintenance, you want to confirm that the cluster is synchronizing the correct configuration areas and that both FortiWeb devices behave consistently in production.
As the FortiWeb administrator, which two configuration areas should you examine to verify that HA synchronization is functioning correctly? (Choose two.)

Check the network configuration on both FortiWeb devices-such as interfaces and static routes-to ensure they are aligned.

Review policy configurations, including server policies and protection profiles, to confirm they match across the cluster.

Review inspection and mitigation log files to determine if they are being replicated across both FortiWeb devices.

Verify whether firmware images and upgrade history are synchronized between the FortiWeb devices.

Q28. Refer to the exhibit.

You are configuring SSL offloading on FortiWeb to protect a public-facing application. Clients connect using HTTPS, while FortiWeb forwards requests to the back-end server using HTTP.
You are reviewing certificate deployment and need to decide where to install the private key for the certificate used in client connections.
In this SSL offloading setup, which device is responsible for using the private key associated with the web server certificate?

FortiWeb, because it terminates the HTTPS session and decrypts traffic.

None. SSL offloading does not require a private key because FortiWeb only forwards traffic.

The server, because it always handles certificates regardless of SSL mode.

The client, because it initiates the TLS handshake and verifies the certificate.

Q29. How should a FortiWeb administrator configure behavior-based bot detection to identify traffic from nonhuman users?

Set request rate limits and enable mouse movement tracking.

Block all traffic that doesn’t come from known devices.

Disable JavaScript execution for anonymous users.

Create IP blocklists based on login failures.

Q30. Refer to the exhibit.

What does the exhibit show?

The FortiGate UI interface in HTML.

A sample response returned by the FortiGate API at https://fortigate.com/ui.

The result of a show ui details command on a FortiWeb server.

An API schema file.

Authentic NSE5_FWB_AD-8.0 Exam Dumps PDF – Sep-2026 Updated: https://www.testsimulate.com/NSE5_FWB_AD-8.0-study-materials.html

Leave a Reply Cancel reply