NSE5_FWB_AD-8.0 Fortinet NSE 5 - FortiWeb 8.0 Administrator Questions and Answers

FortiAI improves investigation workflow by helping administrators interpret FortiWeb activity using natural language. Instead of manually reviewing many raw log entries, administrators can ask FortiAI questions about recent events, blocked requests, attack patterns, or policy behavior and receive a readable explanation. This helps reduce investigation time and makes troubleshooting faster, especially when reviewing attack logs, event logs, and traffic context. FortiAI does not disable logging; that would reduce visibility. It also does not replace FortiGuard updates, which remain important for signatures, reputation, and threat intelligence. Blocking malicious IP addresses automatically is a security action handled through FortiWeb policies and protections, not the primary FortiAI workflow benefit. The best answer is natural-language event explanation.

================

The scenario describes distributed scraping where each individual IP stays below request-rate thresholds. A simple DoS threshold is weak here because the attacker avoids volume-based detection per source. Static blocklists are also ineffective because many botnet IPs may appear only once or rotate frequently. Blocking every non-allowlisted user agent would cause severe false positives and is easy for bots to evade by spoofing headers. FortiWeb bot mitigation is the correct control because it can evaluate behavior beyond source IP volume. Device fingerprinting, browser behavior, headers, JavaScript challenges, and client characteristics help correlate suspicious automation even when requests are spread across many addresses. Therefore, bot mitigation with behavioral/device fingerprinting is the strongest answer.

================

SSRF is an application-layer abuse case where attacker-controlled input causes the backend application to make unintended server-side requests. FortiWeb controls such as parameter validation, file security, and ML anomaly detection reduce risk, but SSRF often succeeds when the application accepts weakly validated URLs, hostnames, redirects, metadata endpoints, internal IP ranges, or backend-only resources. Disabling ML would weaken protection. Moving SSRF protection to FortiGate is wrong because SSRF depends on HTTP/API logic, not only network-layer filtering. HTTPS inspection alone does not solve unsafe backend request behavior. The correct priority is to refine input validation and filtering logic so FortiWeb can better detect and block malicious URL, parameter, and backend-request patterns.

================

The exhibits show a mismatch between the configured server pool and the server pool referenced by the server policy. The server pool containing the two back-end servers is named app-server-pool1 , but the server policy is selecting server-pool1 . In reverse proxy mode, FortiWeb receives traffic on the virtual server and then forwards it to the server pool selected in the server policy. If the policy points to the wrong or empty pool, traffic will not be forwarded to the intended back-end servers, even if health checks for the correct pool are healthy. Client Real IP affects source IP preservation, not pool selection. The FortiGate should forward traffic to FortiWeb, not directly bypass it. The correct fix is to select the correct server pool.

================

A FortiWeb server policy binds the listener, destination pool, and service handling required for traffic flow. The virtual server defines the public-facing listener where client traffic arrives. The server pool defines the real back-end servers or load-balanced pool where FortiWeb forwards accepted traffic. The service or port settings define whether FortiWeb handles HTTP, HTTPS, or another configured service. A WAF profile is important for security inspection, but the question asks for the three components needed to complete the forwarding policy. DNS resolver, URL rewrite, health checks, IPsec tunnels, and static routes may be useful in some deployments, but they are not the required core components of the server policy.

================

When FortiWeb is deployed behind a load balancer or upstream proxy, it may see only the load balancer IP address as the source for every request. This causes poor client identification and can lead FortiWeb to block many legitimate users as if they are one abusive client. The correct fix is to preserve the original client IP address in an HTTP header, commonly using X-Forwarded-For or a similar trusted client-IP header. FortiWeb can then be configured to read that header for accurate client identification, logging, rate limiting, and IP-based security decisions. Bot detection, signature updates, and HTTPS caching do not solve the core source-IP visibility problem.

================

The issue is unauthorized access through a mobile API, so the control must enforce API-specific identity and access rules. FortiWeb API protection can validate API structure, methods, paths, and authorization requirements, while client management can help associate requests with legitimate clients or authenticated users. ZTNA profiles and cookie security can help with access and session protection, but they do not replace API-specific authorization controls. Switching reverse-proxy mode to bypass cookie controls makes no sense and could weaken protection. Replacing ZTNA with bot protection addresses a different problem: automation, not API authorization. Logging only records activity after the fact and does not prevent bypass. The correct action is to enable API protection and client management for mobile API traffic.

================