NSE5_FWB_AD-8.0 Exam Preparation Material | Fortinet NSE 5 - FortiWeb 8.0 Administrator

Explanation:
Traffic logging is more storage-intensive than normal event or attack logging, so FortiWeb does not always expose policy traffic-log selection by default. The Study Guide states that traffic logs must be enabled from the CLI before they can be selected in a server policy. This matches the exhibit: the administrator is in the server policy wizard but cannot see the traffic log option. FortiAnalyzer or FortiSIEM can receive logs, but they do not make the policy option appear. Deployment mode is also not the determining factor here. FortiAppSec Cloud licensing is unrelated. The correct cause is that global traffic logging must first be enabled manually through the CLI, after which policy-based traffic logging can be selected.

Explanation:
Automatic HTTP-to-HTTPS redirection should be enabled when users must be forced onto encrypted communication, especially for applications that process logins, credentials, payment data, personal data, or other sensitive information. HTTP sends traffic without transport encryption, which exposes users to interception, credential theft, session hijacking, and downgrade-style risk. FortiWeb can redirect HTTP requests to HTTPS so users who type or follow an insecure HTTP URL are automatically moved to the secure version of the application. Keeping both HTTP and HTTPS available for flexibility weakens security. Static sites without sensitive data may not require this control. A back-end server using only HTTP is a separate SSL offloading design issue and does not justify leaving client-side traffic unencrypted.

Explanation:
FortiWeb machine learning protection depends on observed application traffic. The administrator must first collect traffic samples so FortiWeb can learn normal behavior and create a useful baseline. After sample collection, FortiWeb uses the collected data to build the detection model. Once the model is built, it must be enabled or run in the live environment so FortiWeb can evaluate production requests and detect abnormal or bot-like behavior. Manual verification on test data only is not enough to activate the model for real traffic. Bayesian analysis is not the FortiWeb configuration step shown for this process; the platform handles model logic internally. The practical workflow is collection, model building, and live enforcement or detection.

Explanation:
In SSL offloading, FortiWeb is the TLS endpoint for client connections. The client negotiates HTTPS with FortiWeb, not directly with the back-end web server. Therefore, FortiWeb must have the website certificate and associated private key so it can complete the TLS handshake, decrypt inbound HTTPS traffic, inspect the HTTP content, and then forward the request to the server using HTTP or a separate back-end connection.
Option B is wrong because TLS termination requires the private key.
Option C describes SSL inspection or direct server termination, not offloading.
Option D is wrong because clients verify the certificate but do not possess or use the server’s private key. FortiWeb owns the private-key function in this design.

Explanation:
The requirement is to track user behavior over time and respond when cumulative activity becomes risky. FortiWeb client management and threat scoring are built for that purpose. When enabled in the protection profile, FortiWeb can associate activity with a client, assign threat weights to suspicious behavior, and apply actions such as alerting, denying, or period blocking after a defined score threshold is exceeded. Rate limiting is useful for traffic volume, but it does not evaluate a user’s full behavior pattern. A custom signature blocks a specific pattern immediately, not cumulative behavior. Cookie security protects session cookies but does not calculate behavioral risk. The correct configuration is scoring in the protection profile to track and respond to repeated risky actions.