Passing Fortinet NSE5_FWB_AD-8.0 Exam Using 2026 Practice Tests [Q19-Q38]

Rate this post

Passing Fortinet NSE5_FWB_AD-8.0 Exam Using 2026 Practice Tests

NSE5_FWB_AD-8.0 Study Guide Brilliant NSE5_FWB_AD-8.0 Exam Dumps PDF

Fortinet NSE5_FWB_AD-8.0 Exam Syllabus Topics:

Section	Weight	Objectives
Application Delivery and Additional Configuration	20%	– Performance and delivery optimization 1. Content routing, URL rewriting, and caching 2. Compression and acceleration – Protection and integration 1. DoS and DDoS protection 2. Logging, monitoring, and FortiAI integration
Web Application and API Security with Bot Mitigation	35%	– API security 1. API protection and access control 2. API discovery and endpoint mapping – Bot mitigation 1. CAPTCHA, reputation, and behavioral analysis 2. Bot detection and classification – Web application security measures 1. Attack signature and threat protection 2. Security profiles and protection rules
Deployment and Configuration	30%	– Deployment modes and basic administration 1. Reverse Proxy, Transparent Bridge, Offline Protection 2. Initial setup and system management – Server objects and security policies 1. Server pool, virtual server configuration 2. Policy creation and rule management – SSL configuration and High Availability 1. SSL inspection, offloading, and certificate management 2. Active-Passive and Active-Active HA deployment
Compliance and Troubleshooting	15%	– Compliance and audit 1. Regulatory compliance standards 2. Vulnerability scanning and reporting – System and traffic troubleshooting 1. Configuration and connectivity issues 2. Log analysis and error diagnosis

NO.19 While reviewing FortiWeb logs, you notice a suspicious login request that failed authentication. You suspect it may be part of an injection attack targeting the login form.
Which input pattern is an example of a typical SQL injection attempt that could bypass authentication checks?

‘||(SELECT password FROM users WHERE role=’admin’)||’

< sql > select(ALL USERS); < /sql >

< script > document.location=’/steal?cookie=’+document.cookie < /script >

SELECT username FROM accounts WHERE username=’admin’;– ‘ AND password=’password’;

NO.20 Refer to the exhibits.

A new domain, https://finance.fortinet.demo, was added but not explicitly mapped. Users report the site loads correctly, but you’re unsure which back-end server is being used.
Why is this request succeeding despite no explicit routing rule for finance.fortinet.demo?

The inherited certificate has a wildcard entry for all subdomains.

FortiWeb auto-generates fallback policies for new domains.

The connection is passed to FortiGate for secondary routing.

The request defaults to app_server_1 because it is marked as the default route.

NO.21 You are a FortiWeb administrator investigating an SQL injection attack on your company’s customer portal.
The network firewall and intrusion prevention system (IPS) did not stop the attack.
You decide to deploy a web application firewall (WAF) to help prevent this type of attack.
Which two actions can you take to block application-layer threats? (Choose two.)

Focus on client-side risks, such as protecting user browsers.

Inspect general network traffic equally between clients and servers.

Detect and block threats like SQL injection, cross-site scripting (XSS), and other Layer 7 attacks.

Filter and analyze HTTP/S requests to block attacks targeting the web server.

NO.22 You are setting up a FortiWeb policy to protect a customer login portal. Users connect to https://login.training.
lab, and you want FortiWeb to forward those requests to a load-balanced pool of back-end servers.
Which three components must you configure to complete the server policy?

Virtual server, server pool, and port settings (service).

Web application firewall (WAF) profile, DoS policy, and server name indication (SNI)-based certificate.

DNS resolver, URL rewrite rule, and HTTP health check.

Real server, IPsec tunnel, and static route.

NO.23 Refer to the exhibit.

You are configuring SSL offloading on FortiWeb to protect a public-facing application. Clients connect using HTTPS, while FortiWeb forwards requests to the back-end server using HTTP.
You are reviewing certificate deployment and need to decide where to install the private key for the certificate used in client connections.
In this SSL offloading setup, which device is responsible for using the private key associated with the web server certificate?

FortiWeb, because it terminates the HTTPS session and decrypts traffic.

None. SSL offloading does not require a private key because FortiWeb only forwards traffic.

The server, because it always handles certificates regardless of SSL mode.

The client, because it initiates the TLS handshake and verifies the certificate.

NO.24 A FortiWeb administrator sees the following request:
GET /api/v1/data HTTP/1.1
Host: example.com
Authorization: ApiKey abc123def456
The API key belongs to a user in group B who is authorized to access only /api/v1/reports.
What should the administrator do to prevent this unauthorized access?

Restrict access to /api/v1/data using user group-based access control.

Block /api/v1/data for all user groups to avoid policy confusion.

Move the user to group A so they can access both endpoints.

Allow all valid API keys to access any API endpoint.

NO.25 A large enterprise has an existing web infrastructure with complex routing rules and static IP address assignments. The network administrators cannot modify the current IP address scheme, but they need FortiWeb to inspect and block threats like SQL injection and cross-site scripting (XSS) without changing the client-server communication flow.
In this situation, which FortiWeb operation mode is the most suitable?

Reverse proxy mode

Web Cache Communication Protocol (WCCP) redirection mode

True transparent proxy mode

Decryption mirror mode

NO.26 A FortiWeb administrator is hardening a customer checkout website.
The site contains sensitive links such as Login, Payment, and Admin, which are embedded in the HTML content of several pages.
A vulnerability scan shows that automated bots can crawl the web pages and easily enumerate these links by parsing the HTML source, even though users access them normally, through the site navigation.
Which FortiWeb feature should the administrator enable to prevent automated scanners from discovering these links?

Link cloaking

URL rewriting

URL encryption

Deep packet inspection

NO.27 Refer to the exhibit.

A FortiWeb administrator is trying to enable policy-based traffic logging on FortiWeb but doesn’t see the traffic log option available in the server policy settings.
What is the most likely reason this option is not visible?

The FortiWeb administrator must first connect to FortiSIEM or FortiAnalyzer, and then enable policy logs from those devices.

Server policy logging only becomes available when FortiWeb is deployed in reverse-proxy mode and transparent mode.

The global traffic log setting must be enabled manually in the CLI for the option to appear.

The FortiWeb administrator must get a license to use this feature with FortiAppSec Cloud.

NO.28 Refer to the exhibit.

A FortiWeb administrator tests a new form input value after training the machine learning (ML) anomaly detection system.
The hidden Markov model (HMM) flags the input as abnormal, while the support vector machine (SVM) model classifies it as normal. FortiWeb allows the request.
What does this result indicate about the FortiWeb ML anomaly detection behavior?

The anomaly detection thresholds are too low and must be increased.

One of the ML models should be disabled to avoid inconsistent results.

FortiWeb is correctly allowing an unusual but non-malicious input based on combined HMM and SVM evaluation.

FortiWeb failed to detect an attack and should have blocked the request.

NO.29 You recently deployed two FortiWeb devices in an active-active (A-A) high availability (HA) cluster.
During routine maintenance, you want to confirm that the cluster is synchronizing the correct configuration areas and that both FortiWeb devices behave consistently in production.
As the FortiWeb administrator, which two configuration areas should you examine to verify that HA synchronization is functioning correctly? (Choose two.)

Check the network configuration on both FortiWeb devices-such as interfaces and static routes-to ensure they are aligned.

Review policy configurations, including server policies and protection profiles, to confirm they match across the cluster.

Review inspection and mitigation log files to determine if they are being replicated across both FortiWeb devices.

Verify whether firmware images and upgrade history are synchronized between the FortiWeb devices.

NO.30 A third-party penetration test reveals that users can bypass login controls through a mobile API. Your current FortiWeb configuration includes zero trust network access (ZTNA) profiles and cookie security, but API protection and client management are not enabled. The security team asks you to recommend the most effective way to close this gap.
Which FortiWeb adjustment would best prevent future unauthorized API access?

Switch to a reverse-proxy mode to bypass cookie-based controls.

Enable API protection and client management to enforce identity checks on mobile API traffic.

Replace ZTNA with bot protection to reduce false positives.

Log only API traffic and rely on FortiAnalyzer for future alerts.

NO.31 You need to monitor and respond to repeated suspicious activity from individual users who are accessing your web application.
Your goal is to evaluate each action the user takes and apply a response when their behavior becomes risky.
What can you configure on FortiWeb to track user behavior and respond automatically when risky activity continues?

Configure rate limiting on the IP reputation blocklist.

Add a custom signature to block suspicious URLs immediately.

Enable automatic cookie security under the server policy.

Set up scoring in the protection profile to track request behavior over time.

NO.32 Refer to the exhibit.

You have deployed FortiWeb behind a FortiGate that is configured as a reverse proxy and inserts the X- Forwarded-For HTTP header when forwarding HTTP and HTTPS traffic.
FortiWeb is using a custom inline protection profile, and logging is enabled, as shown in the exhibit.
You notice that FortiWeb is blocking legitimate users, and all requests in the attack logs appear to come from the FortiGate IP address, not the original client IP address.
Which action should you take to fix this issue?

Replace the current deployment mode with a one-arm proxy to expose source IP addresses.

Disable IP-based detection features on FortiWeb to avoid IP-related blocking.

Recreate the server policy using the predefined profile instead of a custom one.

Modify the protection profile to use the X-Forwarded-For header for client IP address detection.

NO.33 Refer to the exhibits.

You are configuring a FortiWeb device in reverse proxy mode, placed downstream from a FortiGate. The server pool includes two back-end web servers: 10.1.1.21 and 10.1.1.22, and you’ve defined a health check policy.
After completing the server policy configuration and applying it to a virtual server, you notice that FortiWeb is not forwarding traffic to the back-end servers. No errors or health check failures appear in the logs.
Based on the configuration shown in the exhibit, which change should you make to restore back-end traffic flow?