VCEdump

NSE6_FWB-6.4 Fortinet NSE 6 - FortiWeb 6.4

PDF question preview Back to product

Free preview

9 sample questions

The complete product contains 56 questions.

Question formats

Single choice7

Multiple choice2

Compare study plans

Fortinet · NSE6_FWB-6.4

NSE6_FWB-6.4 questions and answers

Review the question wording, option layout, and available explanations before choosing a study plan.

Question 1

Multiple choice

Which is true about HTTPS on FortiWeb? (Choose three.)

A
For SNI, you select the certificate that FortiWeb will present in the server pool, not in the server policy.
B
After enabling HSTS, redirects to HTTPS are no longer necessary.
C
In true transparent mode, the TLS session terminator is a protected web server.
D
Enabling RC4 protects against the BEAST attack, but is not recommended if you configure FortiWeb to only offer TLS 1.2.
E
In transparent inspection mode, you select which certificate that FortiWeb will present in the server pool, not in the server policy.

Reveal answer details Close answer details

Correct answersA, C, E

Question 2

Single choice

When viewing the attack logs on FortiWeb, which client IP address is shown when you are using XFF header rules?

A
FortiGate public IP
B
FortiWeb IP
C
FortiGate local IP
D
Client real IP

Reveal answer details Close answer details

Correct answerD

Explanation

When an XFF header reaches Alteon from a client, Alteon removes all the content from the header and injects the client IP address. Alteon then forwards the header to the server.
References:
https://support.radware.com/app/answers/answer_view/a_id/20925/~/modifying-the-client-ip-address-in-the-xff-header-using-httpmod

Question 3

Single choice

What role does FortiWeb play in ensuring PCI DSS compliance?

A
PCI specifically requires a WAF
B
Provides credit card processing capabilities
C
Provide ability to securely process cash transactions
D
Provides load balancing between multiple web servers

Reveal answer details Close answer details

Correct answerA

Explanation

FortiWeb helps you meet all PCI requirements, but PCI now specifically recommends using a WAF, and developing remediations against the top 10 vulnerabilities, according to OWASP.

Question 4

Single choice

True transparent proxy mode is best suited for use in which type of environment?

A
New networks where infrastructure is not yet defined
B
Flexible environments where you can easily change the IP addressing scheme
C
Small office to home office environments
D
Environments where you cannot change the IP addressing scheme

Reveal answer details Close answer details

Correct answerB

Explanation

"Because blocking is not guaranteed to succeed in offline mode, this mode is best used during the evaluation and planning phase, early in implementation. Reverse proxy is the most popular operating mode. It can rewrite URLs, offload TLS, load balance, and apply NAT. For very large MSSP, true transparent mode has a significant advantage. You can drop it in without changing any schemes of limited IPv4 spacen transparent mode, you don't need to give IP addresses to the network interfaces on FortiWeb."

Question 5

Multiple choice

A client is trying to start a session from a page that should normally be accessible only after they have logged in.

When a start page rule detects the invalid session access, what can FortiWeb do? (Choose three.)

A
Reply with a "403 Forbidden" HTTP error
B
Allow the page access, but log the violation
C
Automatically redirect the client to the login page
D
Display an access policy message, then allow the client to continue, redirecting them to their requested page
E
Prompt the client to authenticate

Reveal answer details Close answer details

Correct answersA, B, C

Question 6

Single choice

Which of the following would be a reason for implementing rewrites?

A
Page has been moved to a new URL
B
Page has been moved to a new IP address
C
Replace vulnerable functions.
D
Send connection to secure channel

Reveal answer details Close answer details

Correct answerC

Question 7

Single choice

When is it possible to use a self-signed certificate, rather than one purchased from a commercial certificate authority?

A
If you are a small business or home office
B
If you are an enterprise whose employees use only mobile devices
C
If you are an enterprise whose resources do not need security
D
If you are an enterprise whose computers all trust your active directory or other CA server

Reveal answer details Close answer details

Correct answerD

Question 8

Single choice

You are configuring FortiAnalyzer to store logs from FortiWeb.

Which is true?

A
FortiAnalyzer will store antivirus and DLP archives from FortiWeb.
B
You must enable ADOMs on FortiAnalyzer.
C
To store logs from FortiWeb 6.4, on FortiAnalyzer, you must select "FrotiWeb 6.1".
D
FortiWeb will query FortiAnalyzer for reports, instead of generating them locally.

Reveal answer details Close answer details

Correct answerB

Question 9

Single choice

When the FortiWeb is configured in Reverse Proxy mode and the FortiGate is configured as an SNAT device, what IP address will the FortiGate's Real Server configuration point at?

A
Virtual Server IP on the FortiGate
B
Server's real IP
C
FortiWeb's real IP
D
IP Address of the Virtual Server on the FortiWeb

Reveal answer details Close answer details

Correct answerA