[Q11-Q27] 2026 Reliable Study Materials & Testing Engine for NSE5_FWB_AD-8.0 Exam Success!

4/5 - (3 votes)

2026 Reliable Study Materials & Testing Engine for NSE5_FWB_AD-8.0 Exam Success!

Validate your Skills with Updated NSE5_FWB_AD-8.0 Exam Questions & Answers and Test Engine

NEW QUESTION 11
You are setting up a FortiWeb policy to protect a customer login portal. Users connect to https://login.training.
lab, and you want FortiWeb to forward those requests to a load-balanced pool of back-end servers.
Which three components must you configure to complete the server policy?

Virtual server, server pool, and port settings (service).

Web application firewall (WAF) profile, DoS policy, and server name indication (SNI)-based certificate.

DNS resolver, URL rewrite rule, and HTTP health check.

Real server, IPsec tunnel, and static route.

NEW QUESTION 12
Refer to the exhibit.

You are a FortiWeb administrator reviewing the biometrics-based detection rule shown in the exhibit. Your goal is to configure a rule that detects bots that avoid typical human interactions like using a mouse or clicking. You also want to log the detection event and apply a high-severity alert.
Based on the current configuration, which settings should you change to meet this goal?

Select Screen Touch and Page Focus , set the severity to Low , and keep action as Deny (no log) .

Select Keyboard and Scroll , change the action to Alert , and set the severity to High .

Select Mouse Movement and Click , change the action to Alert , and set the severity to High .

Do not select any client events to monitor, enable Bot Trait Checking , keep the current severity, and keep the action as Deny (no log) .

NEW QUESTION 13
A large enterprise has an existing web infrastructure with complex routing rules and static IP address assignments. The network administrators cannot modify the current IP address scheme, but they need FortiWeb to inspect and block threats like SQL injection and cross-site scripting (XSS) without changing the client-server communication flow.
In this situation, which FortiWeb operation mode is the most suitable?

Reverse proxy mode

Web Cache Communication Protocol (WCCP) redirection mode

True transparent proxy mode

Decryption mirror mode

NEW QUESTION 14
A FortiWeb administrator wants to create a machine learning (ML)-based bot detection system.
Which three actions must the administrator take to build and activate this ML model? (Choose three.)

Collect traffic samples for training.

Verify the model manually on test data only.

Apply Bayesian analysis to the model output.

Build the detection model using collected data.

Run the model in the live environment.

NEW QUESTION 15
Refer to the exhibit.

A FortiWeb administrator is trying to enable policy-based traffic logging on FortiWeb but doesn’t see the traffic log option available in the server policy settings.
What is the most likely reason this option is not visible?

The FortiWeb administrator must first connect to FortiSIEM or FortiAnalyzer, and then enable policy logs from those devices.

Server policy logging only becomes available when FortiWeb is deployed in reverse-proxy mode and transparent mode.

The global traffic log setting must be enabled manually in the CLI for the option to appear.

The FortiWeb administrator must get a license to use this feature with FortiAppSec Cloud.

NEW QUESTION 16
Refer to the exhibit.

There is only one administrator account configured on FortiWeb and IPv6 is not configured on any interface.
Which action should an administrator take to restrict any brute force attacks that attempt to gain access to the FortiWeb management GUI?

Make configuration changes on the upstream device.

Replace 0.0.0.0/0 with a specific IP address.

Delete the built-in administrator user and create a new one.

Change the setting in the Access Profile field to Read_Only .

NEW QUESTION 17
You are reviewing SSL-related issues on FortiWeb. An administrator reports that they receive a certificate warning when they access the FortiWeb GUI over HTTPS. Separately, your FortiWeb device also makes outbound HTTPS requests to a back-end API server.
In which two situations would FortiWeb use its own certificates to establish or secure the connection?
(Choose two.)

When a client browser initiates an SSL session and FortiWeb is in transparent inspection mode.

When FortiWeb is routing an HTTPS connection to a FortiGate without decrypting it.

When an administrator connects to the FortiWeb GUI using HTTPS in a browser.

When FortiWeb connects to a back-end server over HTTPS as a client.

NEW QUESTION 18
Which situation best explains when a FortiWeb administrator should enable automatic HTTP-to-HTTPS redirection?

The organization prefers to keep both HTTP and HTTPS available for flexibility.

Users are accessing a static website that does not handle sensitive data.

The back-end server uses only HTTP and cannot support encryption.

The web application handles logins or personal data and must ensure encrypted communication.

NEW QUESTION 19
You are hosting multiple secure web applications behind a single public IP address on FortiWeb.
When a client connects to a service, FortiWeb needs to:
* Identify the correct SSL certificate.
* Decrypt the request.
* Route the request to the correct back-end server.
Match each FortiWeb function to the request handling step that performs the function.

NEW QUESTION 20
You need to monitor and respond to repeated suspicious activity from individual users who are accessing your web application.
Your goal is to evaluate each action the user takes and apply a response when their behavior becomes risky.
What can you configure on FortiWeb to track user behavior and respond automatically when risky activity continues?

Configure rate limiting on the IP reputation blocklist.

Add a custom signature to block suspicious URLs immediately.

Enable automatic cookie security under the server policy.

Set up scoring in the protection profile to track request behavior over time.

NEW QUESTION 21
You recently deployed two FortiWeb devices in an active-active (A-A) high availability (HA) cluster.
During routine maintenance, you want to confirm that the cluster is synchronizing the correct configuration areas and that both FortiWeb devices behave consistently in production.
As the FortiWeb administrator, which two configuration areas should you examine to verify that HA synchronization is functioning correctly? (Choose two.)

Check the network configuration on both FortiWeb devices-such as interfaces and static routes-to ensure they are aligned.

Review policy configurations, including server policies and protection profiles, to confirm they match across the cluster.

Review inspection and mitigation log files to determine if they are being replicated across both FortiWeb devices.

Verify whether firmware images and upgrade history are synchronized between the FortiWeb devices.

NEW QUESTION 22
A third-party penetration test reveals that users can bypass login controls through a mobile API. Your current FortiWeb configuration includes zero trust network access (ZTNA) profiles and cookie security, but API protection and client management are not enabled. The security team asks you to recommend the most effective way to close this gap.
Which FortiWeb adjustment would best prevent future unauthorized API access?

Switch to a reverse-proxy mode to bypass cookie-based controls.

Enable API protection and client management to enforce identity checks on mobile API traffic.

Replace ZTNA with bot protection to reduce false positives.

Log only API traffic and rely on FortiAnalyzer for future alerts.

NEW QUESTION 23
You are reviewing a report from your FortiWeb logs and notice a JavaScript payload like < script > document.
cookie < /script > is submitted through a product review form. The page doesn’t filter the script, and when users view the review, their session cookies are exposed.
Why is this attack dangerous?

It executes code in the victim’s browser.

It leaks back-end database information.

It bypasses login pages.

It forces a victim to click malicious links.

NEW QUESTION 24
Refer to the exhibits.

A new domain, https://finance.fortinet.demo, was added but not explicitly mapped. Users report the site loads correctly, but you’re unsure which back-end server is being used.
Why is this request succeeding despite no explicit routing rule for finance.fortinet.demo?