Fortinet NSE 5 - FortiWeb 8.0 Administrator (NSE5_FWB_AD-8.0)

The problem states that FortiWeb is not logging or inspecting traffic despite being in the path, and no server policies are configured. This scenario indicates that FortiWeb is acting as a simple router, forwarding packets between its interfaces without WAF inspection. The ip-forward setting controls this behavior. Disabling ip-forward ensures that FortiWeb will only process traffic that explicitly matches a configured server policy. Since no policies exist, traffic would be blocked, preventing uninspected access to the backend servers.

✅ Option A (Correct)

Reasoning: Rewriting URLs exposing software versions (e.g., "25.3.6") reduces security risk. Attackers perform reconnaissance using version details to find known vulnerabilities. Obfuscating such information hinders these efforts.

❌ Why the other choices are incorrect:

• Option B is incorrect: An RSS feed URL does not inherently present a security risk that URL rewriting directly addresses; risks are usually content or application specific.
• Option C is incorrect: This is a clean, descriptive URL, exposing no sensitive information or structural vulnerabilities requiring security-driven rewriting.
• Option D is incorrect: Similar to C, this clean, descriptive URL poses no inherent security risk based on its structure that URL rewriting would mitigate.

✅ Option C (Correct)
Reasoning: To complete a FortiWeb server policy for a reverse proxy, you must configure a Virtual Server to listen for client connections (e.g., https://login.training.lab), a Server Pool to define the group of back-end servers for load balancing, and Port Settings (service) to specify the listening protocol (HTTPS) and port (443), along with the associated SSL certificate.

❌ Why the other choices are incorrect:

• Option A is incorrect: While 'Real server' refers to backend servers (part of a server pool), IPsec tunnels and static routes are network infrastructure components, not direct FortiWeb server policy configurations.
• Option B is incorrect: WAF profiles and DoS policies are protection mechanisms applied to a policy, not the fundamental components required to establish the traffic forwarding itself. An SNI-based certificate is a specific type of certificate, which is part of port settings.
• Option D is incorrect: A DNS resolver is a system-wide setting, URL rewrite rules are optional for traffic manipulation, and HTTP health checks are a feature within a server pool, not a top-level component for policy completion.

✅ Option A (Correct)
Reasoning: The log message explicitly states "Threshold Based Content Scraping Detection (Bot Detection) violation." This directly indicates that the FortiWeb appliance detected an automated process (bot) attempting to systematically extract (scrape) content from the web application, often by accessing multiple pages. The URL parameter /?p=1 is characteristic of pagination, frequently targeted by scrapers.

❌ Why the other choices are incorrect:

• Option B is incorrect: A Layer 4 SYN flood is a network-level attack, while "Content Scraping Detection" operates at Layer 7 (application level) and focuses on HTTP request patterns, not SYN packets.
• Option C is incorrect: Malformed HTTP requests would typically trigger a "Protocol Violation" or similar alert, not specifically "Content Scraping Detection." The alert focuses on the intent of the requests, not their syntax.
• Option D is incorrect: While vulnerability scanners are bots and can trigger rate limits, the specific message "Content Scraping Detection" points to the primary intent being data extraction, not a general vulnerability scan. The alert's detail is more precise than a generic rate limit or scanner detection.

✅ Option A (Reverse proxy) (Correct)

Reasoning: In Reverse Proxy mode, FortiWeb acts as a full proxy, sitting between clients and the web servers. It terminates client connections, inspects all traffic, and then initiates new connections to the backend servers. This provides the most comprehensive control, enabling active inline inspection, enforcement, and blocking of threats like SQL injection attempts. This mode supports the full FortiWeb security feature set without operational limitations, making it ideal for e-commerce platforms requiring robust protection.

✖ Why the other choices are incorrect:

• Option B is incorrect: Web Cache Communication Protocol (WCCP) integration mode is primarily used for traffic redirection. While it can direct traffic to FortiWeb for inspection, it's not FortiWeb's primary or most direct mode for achieving full inline protection with the least operational limitations for an e-commerce platform.
• Option C is incorrect: Transparent bridge mode deploys FortiWeb inline without changing IP addresses or routing, allowing for inspection and blocking. While it supports many security features, Reverse Proxy offers more comprehensive control over the HTTP/S sessions (e.g., SSL offloading, load balancing) which is typically preferred for full-featured WAF deployment for critical web applications like e-commerce. Given the explicit need for
  
  Reference: https://docs.fortinet.com/document/fortiweb/6.3.0/admin-guide/721345/deployment-modes

FortiWeb's ML anomaly detection leverages both Hidden Markov Model (HMM) and Support Vector Machine (SVM) for comprehensive analysis. When the HMM model flags an input as abnormal but the SVM model classifies it as normal, FortiWeb makes a combined decision. The 'Detection Result: Normal: HMM abnormal but SVM normal' indicates that the overall evaluation considered the input normal, thus allowing the request. This behavior is by design to reduce false positives by requiring a consensus or a higher confidence anomaly score from the combined models before blocking a request.

Reference: https://docs.fortinet.com/document/fortiweb/6.3.0/admin-guide/603407/machine-learning-anomaly-detection

✅ Option B (Correct)

Reasoning: Enabling API protection and client management directly addresses the problem of unauthorized API access and bypassed login controls. FortiWeb's API protection features secure APIs through authentication, schema validation, and access control. Client management (or client integrity checks) verifies the legitimacy of clients, preventing unauthorized mobile API traffic. These are the explicit features designed to mitigate the identified vulnerability.

❌ Why the other choices are incorrect:

• Option A is incorrect: Switching to reverse-proxy mode is FortiWeb's primary operational mode and doesn't inherently solve API bypass issues or strengthen identity checks. It doesn't address the specific API vulnerability.
• Option C is incorrect: Logging traffic and relying on FortiAnalyzer for alerts are reactive measures. The goal is to proactively prevent unauthorized access, not just detect it after the fact.
• Option D is incorrect: Replacing ZTNA with bot protection is irrelevant to the problem of bypassed login controls for APIs. Bot protection differentiates bots from humans, while the core issue is unauthorized user access to the API.

• Option A is correct: SAML (Security Assertion Markup Language) authentication delegates the user login process to an external Identity Provider (IdP), with FortiWeb acting as the Service Provider (SP). HTML authentication, conversely, involves FortiWeb directly handling or proxying the credential submission from its own or the backend server's login page, often authenticating against local servers like LDAP or RADIUS.
• Option B is incorrect: Both SAML and HTML authentication can be applied to internal and cloud applications; the distinction is not based on application deployment location.
• Option C is incorrect: Modern HTML authentication implementations, including FortiWeb's, use HTTPS to encrypt credentials in transit, preventing cleartext transmission. SAML transmits assertions, not typically raw passwords.
• Option D is incorrect: SAML itself is not inherently passwordless, as the user typically authenticates with a password at the IdP. HTML authentication primarily uses username/password credentials, not tokens as the primary authentication mechanism.