NSE5_FWB_AD-8.0 Fortinet NSE 5 - FortiWeb 8.0 Administrator Free Practice Exam Questions (2026 Updated)

The scenario describes distributed scraping where each individual IP stays below request-rate thresholds. A simple DoS threshold is weak here because the attacker avoids volume-based detection per source. Static blocklists are also ineffective because many botnet IPs may appear only once or rotate frequently. Blocking every non-allowlisted user agent would cause severe false positives and is easy for bots to evade by spoofing headers. FortiWeb bot mitigation is the correct control because it can evaluate behavior beyond source IP volume. Device fingerprinting, browser behavior, headers, JavaScript challenges, and client characteristics help correlate suspicious automation even when requests are spread across many addresses. Therefore, bot mitigation with behavioral/device fingerprinting is the strongest answer.

================

The FortiGate is acting as an upstream reverse proxy, so FortiWeb sees the FortiGate address as the direct source IP unless it is configured to read the original client IP from the inserted HTTP header. Since FortiGate already inserts X-Forwarded-For, the proper fix is to modify the FortiWeb protection profile or related client-IP configuration so FortiWeb uses that header for client IP detection. This restores accurate logging, rate limiting, reputation checks, and IP-based enforcement. Changing to one-arm proxy is unnecessary and disruptive. Disabling IP-based detection weakens protection instead of fixing attribution. Recreating the policy with a predefined profile does not address the missing client IP mapping. The correct adjustment is to trust and use X-Forwarded-For.

The exhibit shows FortiWeb using HTTP content routing, with multiple routing policies and one policy marked as the default. The domain finance.fortinet.demo does not match the explicit routing rules shown, so FortiWeb falls back to the default HTTP content routing entry. In the policy table, app_server_1 is marked as the default route, meaning unmatched requests are sent to that server pool. The certificate does not determine back-end routing; it only supports TLS identity. FortiWeb does not automatically create routing policies for new domains, and the request is not passed to FortiGate for secondary content routing. Because no explicit hostname match exists, the default content routing policy handles the request.

================

Option D is the strongest SQL injection example because it uses SQL syntax with a comment marker -- to neutralize the password condition. In a vulnerable login query, that could cause the database to evaluate only the username portion and ignore the password check, creating an authentication bypass. Option C is not SQL injection; it is cross-site scripting because it executes JavaScript in the browser. Option B is fake XML-like markup and not a realistic SQL payload. Option A contains a SQL-like subquery, but it is not the best authentication-bypass pattern shown. FortiWeb’s injection defenses are designed to detect SQL injection and XSS as malicious input patterns targeting application logic.

================

The mapping follows the security risk each FortiWeb feature mitigates. User Tracking maps to Broken Access Control because it helps enforce authenticated-session behavior and can prevent unauthorized access patterns. HSTS Header Security maps to Cryptographic Failures because it forces browsers toward HTTPS and reduces downgrade or weak transport behavior. Padding Oracle Protection also maps to Cryptographic Failures because padding oracle attacks exploit weaknesses in encrypted session or token handling. Web Vulnerability Scan maps to Security Misconfiguration because scans help expose misconfigured, exposed, or vulnerable application components. Session Forwarding fits Insecure Design because it helps enforce expected application flow rather than allowing users or attackers to jump through weakly designed paths.

This is a stored cross-site scripting attack. The attacker submits JavaScript into a product review form, and the application stores and displays it later to other users. When victims view the review, their browsers execute the attacker’s script as if it came from the trusted site. That is dangerous because the script can access browser-side data available to the page, such as cookies, tokens, page content, or session-related information depending on browser and cookie security settings. It does not directly leak the back-end database; that would be more aligned with SQL injection. It also does not inherently bypass login pages or require the victim to click a link. The core risk is malicious code execution in the victim’s browser.

================

When FortiWeb is deployed behind a load balancer or upstream proxy, it may see only the load balancer IP address as the source for every request. This causes poor client identification and can lead FortiWeb to block many legitimate users as if they are one abusive client. The correct fix is to preserve the original client IP address in an HTTP header, commonly using X-Forwarded-For or a similar trusted client-IP header. FortiWeb can then be configured to read that header for accurate client identification, logging, rate limiting, and IP-based security decisions. Bot detection, signature updates, and HTTPS caching do not solve the core source-IP visibility problem.

================

The exhibit is written in structured OpenAPI/YAML-style format. It includes fields such as info, version, title, servers, paths, HTTP method get, operationId, responses, content type application/json, and a schema definition. That is not HTML and it is not a live API response. It is also not CLI output from FortiWeb. FortiWeb OpenAPI validation uses OpenAPI description files in YAML or JSON to define API structure, endpoints, parameters, and expected data types. FortiWeb then uses that uploaded schema as a baseline to validate API requests and block requests that do not conform. So the exhibit is best identified as an API schema file

The URL https://www.example.com/25.3.6/Browse/MediaData exposes internal application structure and what appears to be a version number. Revealing version information, framework paths, or internal directory names gives attackers useful reconnaissance data. Attackers can correlate exposed versions with known vulnerabilities and target the application more precisely. FortiWeb URL rewriting can reduce this risk by hiding or transforming sensitive internal URLs before users or scanners see them. The other URLs are normal-looking public paths or common application resources. A WordPress RSS feed may or may not be appropriate depending on business requirements, but it does not clearly expose internal versioned routing in the same way. The risky URL is the one containing 25.3.6/Browse/MediaData.

================