Important Fortinet NSE5_FWB_AD-8.0 Exam Questions

CertPrep • Fortinet • NSE5_FWB_AD-8.0 Exam Questions

Select Certification Providers

Select Certification Exam

Get Full Version

Fortinet NSE 5 - FortiWeb 8.0 Administrator NSE5_FWB_AD-8.0 Exam

Attempt the Fortinet Certified Professional practice test and solve real exam-like NSE5_FWB_AD-8.0 questions to prepare efficiently and increase your chances of success. Our Fortinet NSE5_FWB_AD-8.0 practice questions match the actual Fortinet NSE 5 - FortiWeb 8.0 Administrator exam format, helping you enhance confidence and improve performance. With our NSE5_FWB_AD-8.0 practice exam software, you can analyze your performance, identify weak areas, and work on them effectively to boost your final Fortinet Certified Professional exam score.

Vendor:	Fortinet
Exam Name:	Fortinet NSE 5 - FortiWeb 8.0 Administrator
Registration Code:	NSE5_FWB_AD-8.0
Related Certification:	Fortinet Certified Professional, Fortinet FCP Fortinet Certified Professional Cloud Security Certifications
Exam Audience:

Total Questions

Last Updated

13-07-2026

Upgrade to Premium

GET FULL PDF

Question: 1

You recently deployed two FortiWeb devices in an active-active (A-A) high availability (HA) cluster.

During routine maintenance, you want to confirm that the cluster is synchronizing the correct configuration areas and that both FortiWeb devices behave consistently in production.

As the FortiWeb administrator, which two configuration areas should you examine to verify that HA synchronization is functioning correctly? (Choose two.)

ACheck the network configuration on both FortiWeb devices---such as interfaces and static routes---to ensure they are aligned.

BReview policy configurations, including server policies and protection profiles, to confirm they match across the cluster.

CReview inspection and mitigation log files to determine if they are being replicated across both FortiWeb devices.

DVerify whether firmware images and upgrade history are synchronized between the FortiWeb devices.

Answer: A, B

Explanation:

To validate HA synchronization, the administrator should compare the configuration areas that affect traffic handling and security enforcement. Network configuration, such as interface and routing alignment, is important because HA peers must process traffic consistently. Policy configuration is also critical because server policies, protection profiles, rules, and related web security settings determine how FortiWeb inspects and blocks requests. Logs are not the right synchronization target for this question; log files are used for investigation, not for proving configuration synchronization. Firmware images and upgrade history are also not the normal operational configuration areas used to verify HA policy behavior. The correct verification focus is network configuration consistency and web protection/server policy consistency across the HA cluster.

================

Question: 2

A FortiWeb administrator is hardening a customer checkout website.

The site contains sensitive links such as Login, Payment, and Admin, which are embedded in the HTML content of several pages.

A vulnerability scan shows that automated bots can crawl the web pages and easily enumerate these links by parsing the HTML source, even though users access them normally, through the site navigation.

Which FortiWeb feature should the administrator enable to prevent automated scanners from discovering these links?

ALink cloaking

BURL rewriting

CURL encryption

DDeep packet inspection

Answer: A

Explanation:

Link cloaking is the FortiWeb feature designed to hide sensitive URLs or links from automated scanners and crawlers that parse HTML source code. In this scenario, the problem is not routing, encryption, or packet inspection; the problem is that bots can read embedded links directly from page content and enumerate sensitive paths such as Login, Payment, and Admin. Link cloaking helps obscure those links so that automated tools cannot easily discover them while normal users can still navigate the site as intended. URL rewriting changes URLs for routing or presentation, but it is not the most precise feature for hiding embedded links from scanners. Deep packet inspection is too broad and does not specifically solve HTML link enumeration.

Question: 3

Refer to the exhibit.

Exam Question 3 Exhibit 1

There is only one administrator account configured on FortiWeb and IPv6 is not configured on any interface.

Which action should an administrator take to restrict any brute force attacks that attempt to gain access to the FortiWeb management GUI?

AMake configuration changes on the upstream device.

BReplace 0.0.0.0/0 with a specific IP address.

CDelete the built-in administrator user and create a new one.

DChange the setting in the Access Profile field to Read_Only.

Answer: B

Explanation:

The exhibit shows the administrator account using IPv4 trusted hosts with a broad entry that effectively allows management access attempts from any IPv4 source. To reduce brute force exposure against the FortiWeb GUI, the administrator should restrict the trusted host entry to a specific trusted management IP address or subnet. FortiWeb administrator accounts can be limited by trusted host settings, so only defined source addresses can even attempt to authenticate. Changing the upstream device may help, but FortiWeb should still enforce its own management access restriction. Deleting the built-in administrator account does not solve the source-access problem. Changing the access profile to read-only only limits privileges after login; it does not prevent brute force attempts against the GUI.

================

Question: 4

A large enterprise has an existing web infrastructure with complex routing rules and static IP address assignments. The network administrators cannot modify the current IP address scheme, but they need FortiWeb to inspect and block threats like SQL injection and cross-site scripting (XSS) without changing the client-server communication flow.

In this situation, which FortiWeb operation mode is the most suitable?

AReverse proxy mode

BWeb Cache Communication Protocol (WCCP) redirection mode

CTrue transparent proxy mode

DDecryption mirror mode

Answer: C

Explanation:

True transparent proxy mode is the correct fit when the organization cannot change the current IP addressing or client-server communication flow. In this mode, FortiWeb is deployed transparently in the traffic path, usually using a Layer 2 bridge or v-zone, so clients still send traffic to the original web server IP address rather than to a FortiWeb virtual server IP. Unlike transparent inspection, true transparent proxy mode can more reliably block malicious traffic inline before forwarding it to the server. Reverse proxy mode normally requires clients or upstream devices to send traffic to FortiWeb's virtual server address. WCCP requires redirection design changes. Decryption mirror mode is mainly passive inspection and is not the best answer for inline blocking.

================

Question: 5

You are a FortiWeb administrator investigating an SQL injection attack on your company's customer portal. The network firewall and intrusion prevention system (IPS) did not stop the attack.

You decide to deploy a web application firewall (WAF) to help prevent this type of attack.

Which two actions can you take to block application-layer threats? (Choose two.)

AFocus on client-side risks, such as protecting user browsers.

BInspect general network traffic equally between clients and servers.

CDetect and block threats like SQL injection, cross-site scripting (XSS), and other Layer 7 attacks.

DFilter and analyze HTTP/S requests to block attacks targeting the web server.

Answer: C, D

Explanation:

A WAF such as FortiWeb is specifically built to protect web applications and web servers from HTTP and HTTPS application-layer attacks. SQL injection and cross-site scripting are Layer 7 threats that exploit web application input handling, not general network-layer forwarding. FortiWeb inspects HTTP/S requests, applies attack signatures, protocol validation, parameter validation, and other web protection controls to detect malicious payloads before they reach the protected application. Option A is wrong because protecting user browsers is mainly endpoint or client security, not WAF server-side protection. Option B is too generic and describes network firewall or IPS-style inspection rather than web application firewall enforcement. The two correct WAF actions are detecting Layer 7 attacks and analyzing HTTP/S requests targeting the web server.

================

SAVE TIME & QUICKLY PREPARE WITH REAL QUESTIONS

GET FULL ACCESS

Other Fortinet Certification Exams

NSE7_SOC_AR-7.6 Exam

Fortinet NSE 7 - Security Operations 7.6 Architect

FCSS_NST_SE-7.6 Exam

Fortinet NSE 6 - Network Security 7.6 Support Engineer

NSE7_SSE_AD-25 Exam

Fortinet NSE 7 - FortiSASE 25 Enterprise Administrator

FCP_FMG_AD-7.6 Exam

Fortinet NSE 5 - FortiManager 7.6 Administrator

NSE6_FSM_AN-7.4 Exam

Fortinet NSE 6 - FortiSIEM 7.4 Analyst

NSE4_FGT_AD-7.6 Exam

Fortinet NSE 4 - FortiOS 7.6 Administrator