[Q10-Q28] BraindumpStudy NSE5_FWB_AD-8.0 Real Exam Question Answers Updated [Aug 12, 2026]

5/5 - (1 vote)

BraindumpStudy NSE5_FWB_AD-8.0 Real Exam Question Answers Updated [Aug 12, 2026]

Easily To Pass New Fortinet NSE5_FWB_AD-8.0 Dumps with 38 Questions

QUESTION 10
You are setting up a FortiWeb policy to protect a customer login portal. Users connect to https://login.training.
lab, and you want FortiWeb to forward those requests to a load-balanced pool of back-end servers.
Which three components must you configure to complete the server policy?

Virtual server, server pool, and port settings (service).

Web application firewall (WAF) profile, DoS policy, and server name indication (SNI)-based certificate.

DNS resolver, URL rewrite rule, and HTTP health check.

Real server, IPsec tunnel, and static route.

QUESTION 11
You are a FortiWeb administrator investigating an SQL injection attack on your company’s customer portal.
The network firewall and intrusion prevention system (IPS) did not stop the attack.
You decide to deploy a web application firewall (WAF) to help prevent this type of attack.
Which two actions can you take to block application-layer threats? (Choose two.)

Focus on client-side risks, such as protecting user browsers.

Inspect general network traffic equally between clients and servers.

Detect and block threats like SQL injection, cross-site scripting (XSS), and other Layer 7 attacks.

Filter and analyze HTTP/S requests to block attacks targeting the web server.

QUESTION 12
You are working on securing HTTPS communication across different services using FortiWeb. Your task is to configure and validate digital certificates for various traffic and communication needs.
Match each FortiWeb certificate feature to the certificate-related task that supports the feature.

QUESTION 13
Refer to the exhibit.

You are a FortiWeb administrator reviewing the biometrics-based detection rule shown in the exhibit. Your goal is to configure a rule that detects bots that avoid typical human interactions like using a mouse or clicking. You also want to log the detection event and apply a high-severity alert.
Based on the current configuration, which settings should you change to meet this goal?

Select Screen Touch and Page Focus , set the severity to Low , and keep action as Deny (no log) .

Select Keyboard and Scroll , change the action to Alert , and set the severity to High .

Select Mouse Movement and Click , change the action to Alert , and set the severity to High .

Do not select any client events to monitor, enable Bot Trait Checking , keep the current severity, and keep the action as Deny (no log) .

QUESTION 14
Refer to the exhibit.

You have deployed FortiWeb behind a FortiGate that is configured as a reverse proxy and inserts the X- Forwarded-For HTTP header when forwarding HTTP and HTTPS traffic.
FortiWeb is using a custom inline protection profile, and logging is enabled, as shown in the exhibit.
You notice that FortiWeb is blocking legitimate users, and all requests in the attack logs appear to come from the FortiGate IP address, not the original client IP address.
Which action should you take to fix this issue?

Replace the current deployment mode with a one-arm proxy to expose source IP addresses.

Disable IP-based detection features on FortiWeb to avoid IP-related blocking.

Recreate the server policy using the predefined profile instead of a custom one.

Modify the protection profile to use the X-Forwarded-For header for client IP address detection.

QUESTION 15
You are reviewing the FortiWeb integration with the Advanced Bot Protection (ABP) service.
Match each step in the ABP flow with its description.

QUESTION 16
A FortiWeb administrator is deciding between using SAML SSO or HTML authentication. They want to minimize the number of credential prompts users receive across multiple Fortinet services.
Which statement accurately describes which option is best, and why?

SAML, because it blocks users from accessing anything not approved in FortiWeb policy.

HTML form, because it provides token-based access to remote services.

SAML SSO, because it supports identity authentication on Fortinet devices.

HTML form authentication, because it’s faster and doesn’t need external systems.

QUESTION 17
A FortiWeb administrator is deciding between using SAML SSO or HTML authentication. They want to minimize the number of credential prompts users receive across multiple Fortinet services.
Which statement accurately describes which option is best, and why?

SAML SSO, because it supports identity authentication on Fortinet devices.

SAML, because it blocks users from accessing anything not approved in FortiWeb policy.

HTML form authentication, because it’s faster and doesn’t need external systems.

HTML form, because it provides token-based access to remote services.

QUESTION 18
A large enterprise has an existing web infrastructure with complex routing rules and static IP address assignments. The network administrators cannot modify the current IP address scheme, but they need FortiWeb to inspect and block threats like SQL injection and cross-site scripting (XSS) without changing the client-server communication flow.
In this situation, which FortiWeb operation mode is the most suitable?

Reverse proxy mode

Web Cache Communication Protocol (WCCP) redirection mode

True transparent proxy mode

Decryption mirror mode

QUESTION 19
You are reviewing a report from your FortiWeb logs and notice a JavaScript payload like < script > document.
cookie < /script > is submitted through a product review form. The page doesn’t filter the script, and when users view the review, their session cookies are exposed.
Why is this attack dangerous?

It executes code in the victim’s browser.

It leaks back-end database information.

It bypasses login pages.

It forces a victim to click malicious links.

QUESTION 20
You are hosting multiple secure web applications behind a single public IP address on FortiWeb.
When a client connects to a service, FortiWeb needs to:
* Identify the correct SSL certificate.
* Decrypt the request.
* Route the request to the correct back-end server.
Match each FortiWeb function to the request handling step that performs the function.

QUESTION 21
Refer to the exhibits.

You are configuring a FortiWeb device in reverse proxy mode, placed downstream from a FortiGate. The server pool includes two back-end web servers: 10.1.1.21 and 10.1.1.22, and you’ve defined a health check policy.
After completing the server policy configuration and applying it to a virtual server, you notice that FortiWeb is not forwarding traffic to the back-end servers. No errors or health check failures appear in the logs.
Based on the configuration shown in the exhibit, which change should you make to restore back-end traffic flow?

Select the correct server pool in the FortiWeb server policy.

Enable Client Real IP to ensure traffic goes to the back-end servers.

Change the virtual server IP address to match one of the back-end servers.

Configure FortiGate to forward traffic to the back-end IP addresses directly.

QUESTION 22
Refer to the exhibit.

You are a FortiWeb administrator reviewing how FortiAI protects sensitive data when interacting with a large language model (LLM).
Drag each label to the corresponding step in the FortiAI data privacy workflow.

QUESTION 23
While reviewing FortiWeb logs, you notice a suspicious login request that failed authentication. You suspect it may be part of an injection attack targeting the login form.
Which input pattern is an example of a typical SQL injection attempt that could bypass authentication checks?

‘||(SELECT password FROM users WHERE role=’admin’)||’

< sql > select(ALL USERS); < /sql >

< script > document.location=’/steal?cookie=’+document.cookie < /script >

SELECT username FROM accounts WHERE username=’admin’;– ‘ AND password=’password’;

QUESTION 24
You recently deployed two FortiWeb devices in an active-active (A-A) high availability (HA) cluster.
During routine maintenance, you want to confirm that the cluster is synchronizing the correct configuration areas and that both FortiWeb devices behave consistently in production.
As the FortiWeb administrator, which two configuration areas should you examine to verify that HA synchronization is functioning correctly? (Choose two.)

Check the network configuration on both FortiWeb devices-such as interfaces and static routes-to ensure they are aligned.

Review policy configurations, including server policies and protection profiles, to confirm they match across the cluster.

Review inspection and mitigation log files to determine if they are being replicated across both FortiWeb devices.

Verify whether firmware images and upgrade history are synchronized between the FortiWeb devices.