About the Exam

The exam validates skills to deploy, configure, administer, manage, and monitor FortiWeb devices that protect web application servers from threats. It is intended for security professionals responsible for FortiWeb configuration, administration, monitoring, and troubleshooting in small enterprise deployments. Passing demonstrates practical knowledge of basic and advanced FortiWeb configuration, day-to-day management, and web application protection.

Exam Topics

Deployment and configuration25%
Web application and API security with botnet mitigation25%
Application delivery and additional configuration25%
Compliance and troubleshooting25%

How to Use This Practice Exam

Browse — Read each question, select your answer, and reveal the explanation.
Exam Mode — Simulate real exam conditions with a timed session and score report.
Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF

Learn More

Last updated August 12, 2026 at 2:10 PM

Topic filter

Question status

Question sort

Questions per page

QuestionQ1

Deployment and configuration

You are configuring a FortiWeb policy to protect a customer login portal. Users connect to https://login.training.lab, and you want FortiWeb to forward those requests to a load-balanced pool of back-end servers.

Which three components must you configure to complete the server policy?

Explanation

A FortiWeb HTTP server policy uses a virtual server as the client-facing listener, a server pool to define and load-balance the back-end web servers, and a predefined or custom service to specify the TCP port on which the virtual server receives HTTPS traffic.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Web application and API security with botnet mitigation

Which URL should be rewritten to lower the security risk?

Explanation

A URL that embeds an explicit software or application version number in its path, such as /25.3.6/, discloses information that helps attackers fingerprint the exact software version in use and cross-reference it against known CVEs, which is a reconnaissance and information-disclosure risk. Web Application Firewalls such as FortiWeb provide URL rewriting policies specifically to strip or obfuscate such version strings and other sensitive path elements before they reach the client, reducing the attack surface, whereas plain content paths (RSS feed endpoints, product listing pages, or static informational pages) do not expose this kind of sensitive version metadata.

Learn more

FortiWeb Administration Guide - URL Rewriting

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Web application and API security with botnet mitigation

Your e-commerce platform is receiving frequent SQL injection attempts. You need FortiWeb to inspect, enforce, and block attacks inline before traffic reaches the web servers.

The deployment must provide the complete FortiWeb security feature set without operational limitations, including protocol validation, attack detection, and policy enforcement.

Which FortiWeb operation mode should you configure to proactively intercept and block threats such as SQL injection attempts?

Explanation

FortiWeb Reverse Proxy mode operates as an intermediary between clients and backend web servers, inspecting HTTP/HTTPS requests before they reach the application and enforcing blocking policies inline. Fortinet documents Reverse Proxy mode as offering the broadest feature support and the highest level of web-application protection.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Web application and API security with botnet mitigation

A third-party penetration test finds that users can bypass login controls via a mobile API. The current FortiWeb configuration includes zero trust network access (ZTNA) profiles and cookie security, but API protection and client management are not enabled. The security team asks you to recommend the most effective approach to close this gap.

Which FortiWeb adjustment would best prevent future unauthorized API access?

Explanation

FortiWeb mobile API protection validates mobile application JWT tokens and can apply enforcement actions when tokens are missing or invalid. Client management identifies clients and can accumulate threat scores that trigger blocking actions. Enabling both provides direct identity-focused protection and enforcement for mobile API traffic.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Application delivery and additional configuration

Which statement most accurately describes the distinction between SAML authentication and HTML authentication in FortiWeb site publishing?

Explanation

SAML authentication redirects or delegates authentication to a SAML identity provider, which returns a signed assertion to FortiWeb. HTML Form Authentication instead has FortiWeb present and manage the web-based login form and authentication flow. Fortinet documents SAML as using SAML servers and signed XML identity information, while HTML Form Authentication presents an HTML authentication form to clients.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ6

Deployment and configuration

Refer to the exhibit.

Question Image

You are a FortiWeb administrator. FortiWeb is deployed between a FortiGate and two back-end web servers, as illustrated in the diagram. No server policies are presently configured on FortiWeb.

During testing, you find that a student system on the 100.64.0.0/24 network can still access the back-end servers in 10.1.1.0/24, although FortiWeb neither logs nor inspects that traffic.

Which action should you take to ensure that FortiWeb blocks or inspects all traffic before it reaches the back-end servers?

Explanation

When ip-forward is enabled, FortiWeb can act as a router and forward traffic addressed directly to a back-end server, without applying a server policy. Disabling ip-forward prevents that unmatched routing path, so traffic cannot pass through uninspected; traffic that is allowed to reach the servers must be processed through the configured FortiWeb protection path.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

It's free

Every verified question is free for all users.
No strings attached.

Topics covered

Deployment and configurationWeb application and API security with botnet mitigationApplication delivery and additional configurationCompliance and troubleshooting