Fortinet FCP_FWB_AD-7.4 Practice Exams
Last updated on Oct 21,2026- Exam Code: FCP_FWB_AD-7.4
- Exam Name: FCP - FortiWeb 7.4 Administrator
- Certification Provider: Fortinet
- Latest update: Oct 21,2026
In Reverse proxy mode, how does FortiWeb handle traffic that does not match any defined policies?
- A . Non-matching traffic is allowed
- B . non-Matching traffic is held in buffer
- C . Non-matching traffic is Denied
- D . Non-matching traffic is rerouted to FortiGate
What is a key consideration when configuring bot detection and mitigation for a web application?
- A . Identifying legitimate user traffic
- B . Increasing server response time
- C . Allowing unrestricted access to APIs
- D . Implementing weaker authentication mechanisms
Which of the following is a key component of web application security that helps protect against common threats like SQL injection and cross-site scripting (XSS)?
- A . CAPTCHA
- B . Intrusion Detection System (IDS)
- C . Web Application Firewall (WAF)
- D . Content Delivery Network (CDN)
What is one of the key benefits of the FortiGuard IP reputation feature?
- A . It maintains a list of private IP addresses.
- B . It provides a document of IP addresses that are suspect, so that administrators can manually update their blacklists.
- C . It is updated once per year.
- D . It maintains a list of public IPs with a bad reputation for participating in attacks.
What is the primary purpose of configuring threat mitigation features in web application security?
- A . Enhancing application performance
- B . Protecting against malicious activities and attacks
- C . Optimizing database management
- D . Improving user interface design
A client is trying to start a session from a page that should normally be accessible only after they have logged in.
When a start page rule detects the invalid session access, what can FortiWeb do? (Choose three.)
- A . Allow the page access, but log the violation
- B . Prompt the client to authenticate
- C . Reply with a "403 Forbidden" HTTP error
- D . Automatically redirect the client to the login page
- E . Display an access policy message, then allow the client to continue, redirecting them to their requested page
Which two configurations are compatible for Wireless Single Sign-On (WSSO)? (Choose two.)
- A . A VAP configured for captive portal authentication
- B . A VAP configured for WPA2 or 3 Enterprise
- C . A VAP configured to authenticate locally on FortiGate
- D . A VAP configured to authenticate using a radius server
When configuring access control for a web application, which methods can be used to enforce security? (Select all that apply)
- A . Role-based access control (RBAC)
- B . Two-factor authentication (2FA)
- C . Captcha verification
- D . IP whitelisting
In which operation mode must you direct all HTTP requests to the web server and not a virtual IP?
- A . Routed proxy
- B . Reverse proxy
- C . Virtual proxy
- D . True transparent proxy
When integrating FortiWeb and FortiAnalyzer, why is the selection for FortiWeb Version critical? (Choose two)
- A . Defines Log file format
- B . Defines communication protocol
- C . Defines Database Schema
- D . Defines Log storage location