NSE5_FWB_AD-8.0 Exam Dumps : Fortinet NSE 5 - FortiWeb 8.0 Administrator

The issue is unauthorized access through a mobile API, so the control must enforce API-specific identity and access rules. FortiWeb API protection can validate API structure, methods, paths, and authorization requirements, while client management can help associate requests with legitimate clients or authenticated users. ZTNA profiles and cookie security can help with access and session protection, but they do not replace API-specific authorization controls. Switching reverse-proxy mode to bypass cookie controls makes no sense and could weaken protection. Replacing ZTNA with bot protection addresses a different problem: automation, not API authorization. Logging only records activity after the fact and does not prevent bypass. The correct action is to enable API protection and client management for mobile API traffic.

================

A WAF such as FortiWeb is specifically built to protect web applications and web servers from HTTP and HTTPS application-layer attacks. SQL injection and cross-site scripting are Layer 7 threats that exploit web application input handling, not general network-layer forwarding. FortiWeb inspects HTTP/S requests, applies attack signatures, protocol validation, parameter validation, and other web protection controls to detect malicious payloads before they reach the protected application. Option A is wrong because protecting user browsers is mainly endpoint or client security, not WAF server-side protection. Option B is too generic and describes network firewall or IPS-style inspection rather than web application firewall enforcement. The two correct WAF actions are detecting Layer 7 attacks and analyzing HTTP/S requests targeting the web server.

================