Free Fortinet NSE5_FWB_AD-8.0 Exam Dumps Questions & Answers

You are reviewing a report from your FortiWeb logs and notice a JavaScript payload like < script > document.
cookie < /script > is submitted through a product review form. The page doesn't filter the script, and when users view the review, their session cookies are exposed.
Why is this attack dangerous?

• A.  It executes code in the victim's browser.
• B.  It forces a victim to click malicious links.
• C.  It bypasses login pages.
• D.  It leaks back-end database information.

You are a FortiWeb administrator investigating an SQL injection attack on your company's customer portal.
The network firewall and intrusion prevention system (IPS) did not stop the attack.
You decide to deploy a web application firewall (WAF) to help prevent this type of attack.
Which two actions can you take to block application-layer threats? (Choose two.)

• A.  Focus on client-side risks, such as protecting user browsers.
• B.  Inspect general network traffic equally between clients and servers.
• C.  Detect and block threats like SQL injection, cross-site scripting (XSS), and other Layer 7 attacks.
• D.  Filter and analyze HTTP/S requests to block attacks targeting the web server.

FortiWeb is blocking groups of users behind your load balancer. In the logs, all users show the same source IP address.
Which action should you take to restore proper client identification?

• A.  Enable caching for HTTPS traffic.
• B.  Update the signature engine.
• C.  Reconfigure the load balancer to insert the original client IP address in an HTTP header.
• D.  Add a bot detection rule in the protection profile.

Refer to the exhibit.


A FortiWeb administrator tests a new form input value after training the machine learning (ML) anomaly detection system.
The hidden Markov model (HMM) flags the input as abnormal, while the support vector machine (SVM) model classifies it as normal. FortiWeb allows the request.
What does this result indicate about the FortiWeb ML anomaly detection behavior?

• A.  FortiWeb is correctly allowing an unusual but non-malicious input based on combined HMM and SVM evaluation.
• B.  FortiWeb failed to detect an attack and should have blocked the request.
• C.  One of the ML models should be disabled to avoid inconsistent results.
• D.  The anomaly detection thresholds are too low and must be increased.

Refer to the exhibit.


A FortiWeb administrator is trying to enable policy-based traffic logging on FortiWeb but doesn't see the traffic log option available in the server policy settings.
What is the most likely reason this option is not visible?

• A.  The global traffic log setting must be enabled manually in the CLI for the option to appear.
• B.  Server policy logging only becomes available when FortiWeb is deployed in reverse-proxy mode and transparent mode.
• C.  The FortiWeb administrator must get a license to use this feature with FortiAppSec Cloud.
• D.  The FortiWeb administrator must first connect to FortiSIEM or FortiAnalyzer, and then enable policy logs from those devices.