Refer to the exhibits.


A new domain, https://finance.fortinet.demo, was added but not explicitly mapped. Users report the site loads correctly, but you're unsure which back-end server is being used.
Why is this request succeeding despite no explicit routing rule for finance.fortinet.demo?

• A.The inherited certificate has a wildcard entry for all subdomains.
• B.FortiWeb auto-generates fallback policies for new domains.
• C.The connection is passed to FortiGate for secondary routing.
• D.The request defaults to app_server_1 because it is marked as the default route.

Comment: *

Name: *

Email: *

Verification: *

A FortiWeb administrator is hardening a customer checkout website.
The site contains sensitive links such as Login, Payment, and Admin, which are embedded in the HTML content of several pages.
A vulnerability scan shows that automated bots can crawl the web pages and easily enumerate these links by parsing the HTML source, even though users access them normally, through the site navigation.
Which FortiWeb feature should the administrator enable to prevent automated scanners from discovering these links?

• A.Link cloaking
• B.URL rewriting
• C.URL encryption
• D.Deep packet inspection

Comment: *

Name: *

Email: *

Verification: *

An administrator needs to deploy FortiWeb so that it is invisible to attackers at the network layer, requires no changes to the existing IP addressing scheme, and does not perform any load balancing. Which operation mode should be used?

• A.Reverse proxy
• B.True transparent proxy
• C.Transparent bridge
• D.Offline protection

Comment: *

Name: *

Email: *

Verification: *

You are reviewing the FortiWeb integration with the Advanced Bot Protection (ABP) service.
Match each step in the ABP flow with its description.

Correct Answer:

Explanation:

The ABP workflow begins when FortiWeb challenges the browser by injecting JavaScript used to collect behavior data. The client browser then executes that JavaScript and sends the observed behavior information to the ABP service. FortiWeb then uses the ABP service decision process to determine whether the browser behavior looks human or automated. If the ABP service identifies the activity as malicious or bot-like, FortiWeb blocks the request before it reaches the protected application. If the request is validated as coming from a real user, FortiWeb allows the traffic to continue to the back-end server. The order is important because FortiWeb cannot allow or block based on ABP until browser behavior has first been collected and evaluated.

Comment: *

Name: *

Email: *

Verification: *