Fortinet FCP_FWB_AD-7.4 Practice Exams
Last updated on Oct 21,2026- Exam Code: FCP_FWB_AD-7.4
- Exam Name: FCP - FortiWeb 7.4 Administrator
- Certification Provider: Fortinet
- Latest update: Oct 21,2026
Which three statements about HTTPS on FortiWeb are true? (Choose three.)
- A . For TLS inspection, you must upload the server certificate and key to FortiWeb.
- B . In transparent inspection mode, FortiWeb supports the same cipher suites as reverse proxy mode.
- C . In reverse proxy mode, FortiWeb can re-encrypt connections to the protected web servers.
- D . You can choose which SSL/TLS protocol versions are supported by FortiWeb when clients connect to a virtual server.
Which operation mode requires additional configuration in order to allow FTP traffic into your web server?
- A . True transparent proxy
- B . Transparent inspection
- C . Reverse proxy
- D . Offline protection
What is a recommended step in troubleshooting threat detection and mitigation issues in a web application?
- A . Reviewing logs and alerts for unusual patterns
- B . Disabling all security features temporarily
- C . Allowing unrestricted access to the application temporarily
- D . Ignoring false positives in the security logs
During FortiWeb deployment, which feature can be used to protect against Distributed Denial of Service (DDoS) attacks?
- A . Server pools
- B . Intrusion Prevention System (IPS)
- C . Load balancing
- D . Rate limiting
Which two statements about running a vulnerability scan are true? (Choose two.)
- A . You should run the vulnerability scan during a maintenance window.
- B . You should run the vulnerability scan in a test environment.
- C . Vulnerability scanning increases the load on FortiWeb, so it should be avoided.
- D . You should run the vulnerability scan on a live website to get accurate results.
In order for FortiWeb to provide the best possible protection for servers, how should you deploy it?
- A . In-line, without FortiGate, deployed in true transparent mode.
- B . In-line, in front of FortiGate, deployed in offline protection mode.
- C . In a one-arm topology, deployed in transparent mode.
- D . In-line, behind FortiGate, deployed in reverse proxy mode.
You are using HTTP content routing on FortiWeb. Requests for web app A should be forwarded to a cluster of web servers which all host the same web app. Requests for web app B should be forwarded to a different, single web server.
Which is true about the solution?
- A . The server policy applies the same protection profile to all its protected web apps.
- B . Static or policy-based routes are not required.
- C . To achieve HTTP content routing, you must chain policies: the first policy accepts all traffic, and forwards requests for web app A to the virtual server for policy A. It also forwards requests for web app B to the virtual server for policy B. Policy A and Policy B apply their app-specific protection profiles, and then distribute that app’s traffic among all members of the server farm.
- D . You must put the single web server into a server pool in order to use it with HTTP content routing.
What is the purpose of a CAPTCHA in web application security?
- A . Authenticating users
- B . Encrypting data in transit
- C . Preventing automated form submissions by bots
- D . Securing API endpoints
What is an advantage of utilizing machine learning for web application security compared to rule-based approaches?
- A . Adaptability to evolving attack patterns
- B . Faster response time to threats
- C . Simplicity in configuration and management
- D . Lower computational resource utilization
Which would be a reason to implement HTTP rewriting?
- A . The original page has moved to a new URL
- B . To replace a vulnerable function in the requested URL
- C . To send the request to secure channel
- D . The original page has moved to a new IP address