During API discovery, which of the following is FortiWeb primarily analyzing to identify API endpoints?

Server logs from backend databases

Incoming HTTP requests and responses to identify API patterns

Configuration files from external API management platforms

DNS queries to map API subdomains

A company is deploying FortiWeb in front of its existing APIs. The security team wants to understand which API endpoints are being used, what methods are called, and what parameters are passed, before creating any protection policies. What should the administrator do first?

Run API discovery to identify and list all API endpoints, methods, and parameters

Enable API gateway mode to route traffic to the backend

Configure API monitoring to generate reports on API usage

Create API protection policies based on the company's documentation

What is 'excessive data exposure' in the context of API security?

An API being unavailable due to high traffic

An API returning more data in its response than the client needs

An API using too much bandwidth

An API storing data in an unencrypted format

What is the purpose of applying an access control policy to an API in FortiWeb?

To change the API's data format from JSON to XML

To backup the API's configuration

To increase the API's response speed

To restrict which clients or IP addresses can call the API

A financial services company is deploying FortiWeb in front of a new customer-facing REST API. The API team has not yet provided a complete inventory of endpoints, and they expect to add new resources over the next quarter. The security team wants FortiWeb to automatically build a baseline of legitimate API traffic without requiring manual endpoint entry. What should the administrator configure first?

Enable API gateway mode on the FortiWeb appliance

Create a static API schema file and upload it to FortiWeb

Enable API discovery with a scheduled scan scope covering the API's base path

Apply a predefined API protection policy to the virtual server

FortinetNSE 5 - FortiWeb Administrator

Domain 2Objective 2

Configure API Discovery and Protection NSE5-FORTIWEB-ADMINISTRATOR Practice Questions (Page 5)

Part of the Web Application and API Security with Botnet Mitigation domain, which makes up ~34% of our current practice bank. Fortinet does not publish an official question count, but from its 65-minute exam (~25–45 total, ~9–15 in this domain), expect 3–5 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

Questions 21–25

21foundation · easy
During API discovery, which of the following is FortiWeb primarily analyzing to identify API endpoints?
Select an answer first
22application · medium
A company is deploying FortiWeb in front of its existing APIs. The security team wants to understand which API endpoints are being used, what methods are called, and what parameters are passed, before creating any protection policies. What should the administrator do first?
Select an answer first
23foundation · easy
What is 'excessive data exposure' in the context of API security?
Select an answer first
24foundation · easy
What is the purpose of applying an access control policy to an API in FortiWeb?
Select an answer first
25application · medium
A financial services company is deploying FortiWeb in front of a new customer-facing REST API. The API team has not yet provided a complete inventory of endpoints, and they expect to add new resources over the next quarter. The security team wants FortiWeb to automatically build a baseline of legitimate API traffic without requiring manual endpoint entry. What should the administrator configure first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE5-FORTIWEB-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE5-FORTIWEB-ADMINISTRATOR” is a trademark of its owner, used for identification only.