Which situation best explains when a FortiWeb administrator should enable automatic HTTP-to-HTTPS redirection?

• A.The organization prefers to keep both HTTP and HTTPS available for flexibility.
• B.Users are accessing a static website that does not handle sensitive data.
• C.The back-end server uses only HTTP and cannot support encryption.
• D.The web application handles logins or personal data and must ensure encrypted communication.

Comment: *

Name: *

Email: *

Verification: *

A FortiWeb administrator is deciding between using SAML SSO or HTML authentication. They want to minimize the number of credential prompts users receive across multiple Fortinet services.
Which statement accurately describes which option is best, and why?

• A.SAML SSO, because it supports identity authentication on Fortinet devices.
• B.SAML, because it blocks users from accessing anything not approved in FortiWeb policy.
• C.HTML form authentication, because it's faster and doesn't need external systems.
• D.HTML form, because it provides token-based access to remote services.

Comment: *

Name: *

Email: *

Verification: *

Drag and Drop Question
A FortiWeb administrator is reviewing protection effectiveness after a surge in malicious traffic exposed design flaws and misconfigurations in several web applications.
For each Open Web Application Security Project (OWASP) risk listed, choose the FortiWeb feature that offers the most strategic protection, considering both coverage depth and operational effectiveness.
Match the most appropriate FortiWeb feature to each OWASP issue.
Select each FortiWeb feature in the left column, hold and drag it to the blank space next to the OWASP issue in the column on the right. Once you match a FortiWeb feature to the OWASP issue, you can move it again if you want to change your answer by clicking on the FortiWeb feature. You need to match five FortiWeb features to the OWASP issue in the work area.

Correct Answer:

Explanation:
A01: Broken Access Control → Site publish
A03: Injection → Parameter validation
A04: Insecure Design → Web vulnerability scan
A05: Security Misconfiguration → HSTS header
Site publish helps enforce controlled access to protected applications. Parameter validation restricts unsafe or unexpected input that could be used in injection attacks. Web vulnerability scanning helps identify application weaknesses and design-related exposure before attackers exploit them. HSTS reduces security misconfiguration risk by forcing browsers to use HTTPS for the protected site.

Comment: *

Name: *

Email: *

Verification: *

Which URL should you rewrite to reduce security risk?

• A.https://www.example.com/25.3.6/Browse/MediaData
• B.https://www.example.com/wordpress/?feed=rss2
• C.https://www.example.com/products/today
• D.https://www.example.com/about/team

Comment: *

Name: *

Email: *

Verification: *

Which statement best describes the purpose of FortiWeb's "combination access control" rules?

• A.They combine multiple individual match conditions (such as source IP, geography, and HTTP header) into a single rule to make more precise access decisions.
• B.They merge SSL certificates from multiple vendors into one chain.
• C.They combine HA cluster members into a single logical unit.
• D.They merge server pools from separate virtual servers.

Comment: *

Name: *

Email: *

Verification: *