Configure API Discovery and Protection NSE5-FORTIWEB-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   After running API discovery, a FortiWeb administrator reviews the learned schema and notices that a /users/{id} endpoint is recorded with a parameter named 'id' but no data type is shown. The API documentation states that 'id' must be an integer. What should the administrator do to ensure FortiWeb can validate requests against this requirement?

   • ACreate a new API protection policy that blocks non-integer values
   • BManually edit the learned schema to define 'id' as an integer type
   • CRe-run API discovery with a broader scope to capture more traffic
   • DEnable threat detection for SQL injection on the /users/{id} endpoint
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A development team is rolling out a new API in phases. The first phase includes only the /v1/users and /v1/products endpoints. The security team wants FortiWeb to discover only these endpoints and not any other paths that might be accessed on the same virtual server. What should the administrator configure?

   • AEnable API gateway mode to route only the specified paths
   • BCreate a protection policy for the /v1/users and /v1/products endpoints
   • CSet the API discovery scope to the /v1/users and /v1/products paths
   • DEnable API discovery with a schedule that runs during off-peak hours
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization uses FortiWeb to protect its patient-facing API. The security team notices that a /patients/{id} endpoint is returning full medical records when the requesting application only needs a summary. This is causing excessive data exposure. What should the administrator configure to mitigate this issue?

   • AEnable API schema validation to restrict the response fields returned by the endpoint
   • BEnable bot mitigation to block automated requests to the endpoint
   • CAdd an access control rule to require stronger authentication for the endpoint
   • DConfigure rate limiting on the /patients/{id} endpoint to reduce data exposure
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial API exposes a /transfer endpoint that accepts a 'amount' parameter. Attackers have been sending requests with negative amounts to exploit a business logic flaw. The API schema defines 'amount' as a positive number. The security team wants FortiWeb to block negative amounts while allowing all other valid requests. What should the administrator configure?

   • AEnable bot mitigation to block automated requests to the endpoint
   • BEnable rate limiting on the /transfer endpoint to reduce the number of requests
   • CCreate a custom report to track negative amount requests
   • DEdit the API schema to define 'amount' with a minimum value of 0
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's API has a /v1/orders endpoint that is accessed by both a web application and a mobile app. The web application uses OAuth tokens, while the mobile app uses API keys. The security team wants FortiWeb to enforce different rate limits for each client type. What should the administrator configure?

   • AEnable API discovery to identify the client types automatically
   • BCreate two API protection policies with different rate limits and apply them based on client authentication type
   • CEnable API gateway mode to route traffic based on the client type
   • DConfigure a single rate limit that is low enough for both client types
   Reveal Solution Discussion Select an answer first