Fortinet Fortinet NSE 5 - FortiWeb 8.0 Administrator NSE5_FWB_AD-8.0 Exam Dumps: Updated Questions & Answers (September 2026)

True transparent proxy mode is the correct fit when the organization cannot change the current IP addressing or client-server communication flow. In this mode, FortiWeb is deployed transparently in the traffic path, usually using a Layer 2 bridge or v-zone, so clients still send traffic to the original web server IP address rather than to a FortiWeb virtual server IP. Unlike transparent inspection, true transparent proxy mode can more reliably block malicious traffic inline before forwarding it to the server. Reverse proxy mode normally requires clients or upstream devices to send traffic to FortiWeb’s virtual server address. WCCP requires redirection design changes. Decryption mirror mode is mainly passive inspection and is not the best answer for inline blocking.

================

The ABP workflow begins when FortiWeb challenges the browser by injecting JavaScript used to collect behavior data. The client browser then executes that JavaScript and sends the observed behavior information to the ABP service. FortiWeb then uses the ABP service decision process to determine whether the browser behavior looks human or automated. If the ABP service identifies the activity as malicious or bot-like, FortiWeb blocks the request before it reaches the protected application. If the request is validated as coming from a real user, FortiWeb allows the traffic to continue to the back-end server. The order is important because FortiWeb cannot allow or block based on ABP until browser behavior has first been collected and evaluated.

================

SAML SSO is the correct choice when the goal is to reduce repeated credential prompts across multiple services. SAML uses a federated identity model, where users authenticate through an identity provider and then use assertions to access service providers without repeatedly entering credentials. This is exactly the value of single sign-on. HTML form authentication is more local and application-specific; it can authenticate users to a protected site, but it does not provide the same cross-service identity federation. Option B overstates SAML as a policy-blocking mechanism. Option C may be simpler but does not meet the SSO requirement. Option D incorrectly describes HTML form authentication as token-based remote-service access.

================

FortiWeb machine learning uses layered detection rather than treating every unusual value as malicious. The HMM layer models normal parameter behavior and can flag a value as abnormal when it falls outside the learned distribution. However, abnormal does not automatically mean hostile. FortiWeb then uses additional ML classification logic, including SVM-based evaluation, to determine whether the anomaly resembles an actual attack or simply a legitimate unusual input. In this case, HMM noticed that the value was uncommon, but SVM classified it as normal, so FortiWeb allowed the request. That is expected behavior. Raising thresholds, disabling models, or assuming FortiWeb failed would misunderstand the two-stage ML decision process.

================

In SSL offloading, FortiWeb is the TLS endpoint for client connections. The client negotiates HTTPS with FortiWeb, not directly with the back-end web server. Therefore, FortiWeb must have the website certificate and associated private key so it can complete the TLS handshake, decrypt inbound HTTPS traffic, inspect the HTTP content, and then forward the request to the server using HTTP or a separate back-end connection. Option B is wrong because TLS termination requires the private key. Option C describes SSL inspection or direct server termination, not offloading. Option D is wrong because clients verify the certificate but do not possess or use the server’s private key. FortiWeb owns the private-key function in this design.

The exhibit shows FortiWeb using HTTP content routing, with multiple routing policies and one policy marked as the default. The domain finance.fortinet.demo does not match the explicit routing rules shown, so FortiWeb falls back to the default HTTP content routing entry. In the policy table, app_server_1 is marked as the default route, meaning unmatched requests are sent to that server pool. The certificate does not determine back-end routing; it only supports TLS identity. FortiWeb does not automatically create routing policies for new domains, and the request is not passed to FortiGate for secondary content routing. Because no explicit hostname match exists, the default content routing policy handles the request.

================

Automatic HTTP-to-HTTPS redirection should be enabled when users must be forced onto encrypted communication, especially for applications that process logins, credentials, payment data, personal data, or other sensitive information. HTTP sends traffic without transport encryption, which exposes users to interception, credential theft, session hijacking, and downgrade-style risk. FortiWeb can redirect HTTP requests to HTTPS so users who type or follow an insecure HTTP URL are automatically moved to the secure version of the application. Keeping both HTTP and HTTPS available for flexibility weakens security. Static sites without sensitive data may not require this control. A back-end server using only HTTP is a separate SSL offloading design issue and does not justify leaving client-side traffic unencrypted.

Option D is the strongest SQL injection example because it uses SQL syntax with a comment marker -- to neutralize the password condition. In a vulnerable login query, that could cause the database to evaluate only the username portion and ignore the password check, creating an authentication bypass. Option C is not SQL injection; it is cross-site scripting because it executes JavaScript in the browser. Option B is fake XML-like markup and not a realistic SQL payload. Option A contains a SQL-like subquery, but it is not the best authentication-bypass pattern shown. FortiWeb’s injection defenses are designed to detect SQL injection and XSS as malicious input patterns targeting application logic.

================

The problem is not that the API key is invalid; the key belongs to a real user. The issue is authorization scope: group B is allowed only to access /api/v1/reports, but the request targets /api/v1/data. The correct FortiWeb control is API gateway rule enforcement using API key verification and API user grouping. FortiWeb can restrict API access by user group, sub-URL, API key verification, and configured violation actions. Blocking the endpoint for every group is too broad, moving the user to another group grants unnecessary privilege, and allowing all API keys to access all endpoints destroys endpoint-level authorization. The correct fix is group-based access control on /api/v1/data.

================