NSE5-FWB-AD-8-0: Fortinet NSE 5 - FortiWeb 8.0 Administrator

By Fortinet · Question Mode

QuestionQ4

VerifiedWeb application and API security with botnet mitigation

A third-party penetration test finds that users can bypass login controls via a mobile API. The current FortiWeb configuration includes zero trust network access (ZTNA) profiles and cookie security, but API protection and client management are not enabled. The security team asks you to recommend the most effective approach to close this gap.

Which FortiWeb adjustment would best prevent future unauthorized API access?

Explanation

FortiWeb mobile API protection validates mobile application JWT tokens and can apply enforcement actions when tokens are missing or invalid. Client management identifies clients and can accumulate threat scores that trigger blocking actions. Enabling both provides direct identity-focused protection and enforcement for mobile API traffic.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!