FCP-FWB-AD-7-4 FCP - FortiWeb 7.4 Administrator Practice Questions

Server Name Indication (SNI) is a TLS extension that allows a client to indicate which hostname it is attempting to connect to at the start of the handshake process. This allows a server (or a proxy like FortiWeb) to present multiple certificates on the same IP address and port number. By configuring SNI on FortiWeb, the administrator can map each unique SSL certificate to its corresponding hostname, enabling tailored security policies for each site.

This statement is true. Fortinet officially recommends a minimum data sampling period of seven days to build an accurate and reliable machine learning model. This duration allows the engine to observe a full weekly traffic cycle, including variations between weekdays and weekends, which is crucial for establishing a comprehensive baseline of normal behavior and minimizing false positives.

FortiWeb's 'Cookie Security' feature can be configured to encrypt all cookies passed between the client and the server. If this feature is enabled, but the back-end application is not designed to handle encrypted session cookies, it will be unable to read them, leading to session termination. The solution is to add the specific session cookie name to the exception list within the Cookie Security policy, allowing it to pass through unmodified while other cookies remain encrypted.

True Transparent Proxy mode is designed for this exact scenario. It places the FortiWeb inline, allowing it to inspect and block traffic. Because it operates as a transparent Layer 2 bridge, it does not modify the IP headers, thus preserving the original client source IP address when the traffic reaches the backend servers. Reverse Proxy mode hides the source IP (requiring X-Forwarded-For), and Offline Protection cannot block traffic.

The diagram correctly illustrates the behavior of a reverse proxy. The client establishes a connection (Connection 1) only with the FortiWeb. The FortiWeb then terminates this connection and, acting as a client itself, establishes a completely separate connection (Connection 2) to the backend web server. This full proxy architecture allows FortiWeb to decrypt, inspect, and modify the traffic before forwarding it.

The most appropriate action is to create exceptions for the specific, legitimate traffic that is being misidentified. FortiWeb's ML allows administrators to review detected anomalies and mark them as false positives, effectively training the model to ignore similar legitimate patterns in the future. This refines the model's accuracy without disabling it or lowering its overall sensitivity, which would expose the application to other threats.

The primary step in configuring CORS is to explicitly whitelist the origin from which the cross-domain requests are allowed. In this case, the front-end application's domain must be added to the 'Allowed Origins' list.

Because the request includes a custom header (X-Auth-Token), this header must be explicitly listed in the 'Allowed Headers' section of the CORS rule. Without this, the browser's preflight OPTIONS request will fail, blocking the actual POST request.

ML-based API Protection with continuous learning is the ideal solution for dynamic API environments. It analyzes live traffic to automatically discover and model the API structure, including endpoints and parameters. The continuous adjustment feature (new in 7.4) allows the model to adapt to frequent changes from a CI/CD pipeline without manual intervention, providing protection even without a static schema.

This statement is false. Layer 7 content rewriting, such as modifying HTTP headers or rewriting content in the body, requires FortiWeb to act as a full proxy that terminates the connection. This functionality is available in Reverse Proxy mode, typically with SSL offloading, but not in True Transparent Proxy mode, which operates at a lower level to inspect traffic without terminating the session.

ML-based Bot Detection using biometric modeling is specifically designed to counter sophisticated bots that mimic human behavior. It analyzes subtle patterns like mouse movements, typing speed, and mobile device orientation (part of the 13 behavioral dimensions) to create a model of genuine human interaction. This allows it to distinguish advanced bots from real users, which simpler methods like rate limiting or signature matching cannot do.