Fortinet NSE5_FWB_AD-8.0 - Fortinet NSE 5 - FortiWeb 8.0 Administrator

The FortiGate is acting as an upstream reverse proxy, so FortiWeb sees the FortiGate address as the direct source IP unless it is configured to read the original client IP from the inserted HTTP header. Since FortiGate already inserts X-Forwarded-For, the proper fix is to modify the FortiWeb protection profile or related client-IP configuration so FortiWeb uses that header for client IP detection. This restores accurate logging, rate limiting, reputation checks, and IP-based enforcement. Changing to one-arm proxy is unnecessary and disruptive. Disabling IP-based detection weakens protection instead of fixing attribution. Recreating the policy with a predefined profile does not address the missing client IP mapping. The correct adjustment is to trust and use X-Forwarded-For.

Traffic logging is more storage-intensive than normal event or attack logging, so FortiWeb does not always expose policy traffic-log selection by default. The Study Guide states that traffic logs must be enabled from the CLI before they can be selected in a server policy. This matches the exhibit: the administrator is in the server policy wizard but cannot see the traffic log option. FortiAnalyzer or FortiSIEM can receive logs, but they do not make the policy option appear. Deployment mode is also not the determining factor here. FortiAppSec Cloud licensing is unrelated. The correct cause is that global traffic logging must first be enabled manually through the CLI, after which policy-based traffic logging can be selected.

================

The correct answers are C and D. FortiWeb uses its own built-in/self-signed or configured server certificate when an administrator connects to the FortiWeb GUI over HTTPS. FortiWeb can also authenticate as a client when it connects to protected back-end servers over HTTPS, and it may present its own certificate for client PKI authentication. Option A is wrong because transparent inspection mode does not make FortiWeb the SSL endpoint in the same way; it inspects traffic without acting as the primary TLS termination point. Option B is also wrong because simply routing HTTPS without decryption does not require FortiWeb to present its own certificate. FortiWeb certificates matter when FortiWeb is an HTTPS endpoint or an authenticated HTTPS client.

================

Option D is the strongest SQL injection example because it uses SQL syntax with a comment marker -- to neutralize the password condition. In a vulnerable login query, that could cause the database to evaluate only the username portion and ignore the password check, creating an authentication bypass. Option C is not SQL injection; it is cross-site scripting because it executes JavaScript in the browser. Option B is fake XML-like markup and not a realistic SQL payload. Option A contains a SQL-like subquery, but it is not the best authentication-bypass pattern shown. FortiWeb’s injection defenses are designed to detect SQL injection and XSS as malicious input patterns targeting application logic.

================

FortiWeb bot mitigation is designed to distinguish automated clients from real human users by evaluating request behavior and browser interaction signals. Request-rate limits help detect automation patterns such as excessive requests over a short period, while mouse movement tracking is a behavioral or biometric-style control that helps confirm whether a browser session is being operated by a human. Blocking all unknown devices is too aggressive and would create major false positives. Disabling JavaScript for anonymous users would actually weaken behavior collection because FortiWeb uses JavaScript-based techniques in some bot workflows. Login-failure IP blocklists help against credential attacks, but they do not broadly identify nonhuman users. Therefore, request limits plus mouse movement tracking is the best answer.

================

A WAF such as FortiWeb is specifically built to protect web applications and web servers from HTTP and HTTPS application-layer attacks. SQL injection and cross-site scripting are Layer 7 threats that exploit web application input handling, not general network-layer forwarding. FortiWeb inspects HTTP/S requests, applies attack signatures, protocol validation, parameter validation, and other web protection controls to detect malicious payloads before they reach the protected application. Option A is wrong because protecting user browsers is mainly endpoint or client security, not WAF server-side protection. Option B is too generic and describes network firewall or IPS-style inspection rather than web application firewall enforcement. The two correct WAF actions are detecting Layer 7 attacks and analyzing HTTP/S requests targeting the web server.

================

When FortiWeb is deployed behind a load balancer or upstream proxy, it may see only the load balancer IP address as the source for every request. This causes poor client identification and can lead FortiWeb to block many legitimate users as if they are one abusive client. The correct fix is to preserve the original client IP address in an HTTP header, commonly using X-Forwarded-For or a similar trusted client-IP header. FortiWeb can then be configured to read that header for accurate client identification, logging, rate limiting, and IP-based security decisions. Bot detection, signature updates, and HTTPS caching do not solve the core source-IP visibility problem.

================

This is a stored cross-site scripting attack. The attacker submits JavaScript into a product review form, and the application stores and displays it later to other users. When victims view the review, their browsers execute the attacker’s script as if it came from the trusted site. That is dangerous because the script can access browser-side data available to the page, such as cookies, tokens, page content, or session-related information depending on browser and cookie security settings. It does not directly leak the back-end database; that would be more aligned with SQL injection. It also does not inherently bypass login pages or require the victim to click a link. The core risk is malicious code execution in the victim’s browser.

================

True transparent proxy mode is the correct fit when the organization cannot change the current IP addressing or client-server communication flow. In this mode, FortiWeb is deployed transparently in the traffic path, usually using a Layer 2 bridge or v-zone, so clients still send traffic to the original web server IP address rather than to a FortiWeb virtual server IP. Unlike transparent inspection, true transparent proxy mode can more reliably block malicious traffic inline before forwarding it to the server. Reverse proxy mode normally requires clients or upstream devices to send traffic to FortiWeb’s virtual server address. WCCP requires redirection design changes. Decryption mirror mode is mainly passive inspection and is not the best answer for inline blocking.

================