NSE5_FWB_AD-8.0 Fortinet NSE 5 - FortiWeb 8.0 Administrator Questions and Answers

The URL https://www.example.com/25.3.6/Browse/MediaData exposes internal application structure and what appears to be a version number. Revealing version information, framework paths, or internal directory names gives attackers useful reconnaissance data. Attackers can correlate exposed versions with known vulnerabilities and target the application more precisely. FortiWeb URL rewriting can reduce this risk by hiding or transforming sensitive internal URLs before users or scanners see them. The other URLs are normal-looking public paths or common application resources. A WordPress RSS feed may or may not be appropriate depending on business requirements, but it does not clearly expose internal versioned routing in the same way. The risky URL is the one containing 25.3.6/Browse/MediaData.

================

The exhibit is written in structured OpenAPI/YAML-style format. It includes fields such as info, version, title, servers, paths, HTTP method get, operationId, responses, content type application/json, and a schema definition. That is not HTML and it is not a live API response. It is also not CLI output from FortiWeb. FortiWeb OpenAPI validation uses OpenAPI description files in YAML or JSON to define API structure, endpoints, parameters, and expected data types. FortiWeb then uses that uploaded schema as a baseline to validate API requests and block requests that do not conform. So the exhibit is best identified as an API schema file

The layered browser-protection model separates prevention, runtime detection, and post-compromise mitigation. CORS protection belongs in the first stage because it restricts which origins can interact with protected resources, helping prevent unauthorized cross-origin access before exploitation occurs. Subresource integrity belongs in the second stage because it detects whether externally loaded scripts or resources have been modified at runtime by comparing them against expected integrity values. HTTP header-based protection belongs in the mitigation stage because security headers can limit the impact of browser-side compromise by controlling browser behavior, enforcing restrictions, and reducing exploit capability. The correct sequence is therefore CORS first, subresource integrity second, and HTTP header request last.

================

FortiWeb bot mitigation separates malicious bots from useful bots such as legitimate search engine crawlers. The FortiGuard Known Search Engines category is designed for this exact use case: allowing recognized search engines to crawl and index protected websites without being treated as hostile automation. Adding a source IP to a general trusted IP list may allow the crawler, but it is broader than necessary because it can bypass more protections than intended. An inline profile exception is more manual and less clean. User-agent exceptions are weak because user-agent strings are easy to spoof. The best FortiWeb-native approach is to use the known search engine handling within bot mitigation so legitimate indexing remains available while malicious bots remain controlled.

================

The goal is to detect bots that avoid normal human interaction, specifically mouse use and clicking, while logging the event and treating it as high severity. In FortiWeb biometrics-based bot detection, monitored client events such as mouse movement, click, keyboard, screen touch, page focus, and scroll help FortiWeb distinguish human behavior from automated behavior. Since the question specifically mentions mouse and clicking, the correct monitored events are Mouse Movement and Click . The current action is Deny (no log) , which would not meet the logging requirement. Changing the action to Alert logs the event instead of silently denying it, and setting severity to High aligns with the requirement for a high-severity alert.

================

FortiAI improves investigation workflow by helping administrators interpret FortiWeb activity using natural language. Instead of manually reviewing many raw log entries, administrators can ask FortiAI questions about recent events, blocked requests, attack patterns, or policy behavior and receive a readable explanation. This helps reduce investigation time and makes troubleshooting faster, especially when reviewing attack logs, event logs, and traffic context. FortiAI does not disable logging; that would reduce visibility. It also does not replace FortiGuard updates, which remain important for signatures, reputation, and threat intelligence. Blocking malicious IP addresses automatically is a security action handled through FortiWeb policies and protections, not the primary FortiAI workflow benefit. The best answer is natural-language event explanation.

================