A company is using FortiWeb as an API gateway. The /v1/users endpoint is served by two different backend services: one for internal users and one for external users. The routing decision is based on a custom header 'X-User-Type'. The security team wants FortiWeb to route requests to the correct backend and apply a stricter protection policy for external users. What should the administrator configure?

Create a single protection policy that applies to all /v1/users traffic

Enable API discovery to identify the 'X-User-Type' header as a parameter

Configure API gateway routing rules based on the 'X-User-Type' header and apply different protection policies to each route

Configure rate limiting on the /v1/users endpoint to protect both backends

Which of the following is an example of information that FortiWeb learns and stores as part of the API schema?

The IP address of the API server

The expected data type of a parameter, such as integer or string

The license key of the API client

A retail company exposes a public API for its mobile app. The API has a /checkout endpoint that is frequently abused by attackers attempting to submit orders with manipulated prices. The security team wants FortiWeb to block requests where the 'total' parameter does not match the expected numeric format, while still allowing legitimate traffic. What should the administrator configure?

Configure rate limiting on the /checkout endpoint to reduce the number of requests

Enable API schema validation on the /checkout endpoint to enforce the 'total' parameter type

Enable bot mitigation to block automated clients from accessing the endpoint

Add an access control rule to restrict the endpoint to authenticated users only

What is the purpose of setting a discovery scope in FortiWeb's API discovery configuration?

To limit discovery to specific API paths or domains

To specify the backup location for discovery logs

To define the encryption algorithm for API traffic

To set the maximum number of API requests per second

FortinetNSE 5 - FortiWeb Administrator

Domain 2Objective 2

Configure API Discovery and Protection NSE5-FORTIWEB-ADMINISTRATOR Practice Questions (Page 6)

Part of the Web Application and API Security with Botnet Mitigation domain, which makes up ~34% of our current practice bank. Fortinet does not publish an official question count, but from its 65-minute exam (~25–45 total, ~9–15 in this domain), expect 3–5 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

Questions 26–30

26foundation · easy
Which FortiWeb feature is used to monitor API traffic and generate reports on API usage and security events?
Select an answer first
27expert · hard
A company is using FortiWeb as an API gateway. The /v1/users endpoint is served by two different backend services: one for internal users and one for external users. The routing decision is based on a custom header 'X-User-Type'. The security team wants FortiWeb to route requests to the correct backend and apply a stricter protection policy for external users. What should the administrator configure?
Select an answer first
28foundation · easy
Which of the following is an example of information that FortiWeb learns and stores as part of the API schema?
Select an answer first
29application · medium
A retail company exposes a public API for its mobile app. The API has a /checkout endpoint that is frequently abused by attackers attempting to submit orders with manipulated prices. The security team wants FortiWeb to block requests where the 'total' parameter does not match the expected numeric format, while still allowing legitimate traffic. What should the administrator configure?
Select an answer first
30foundation · easy
What is the purpose of setting a discovery scope in FortiWeb's API discovery configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE5-FORTIWEB-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE5-FORTIWEB-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Configure API Discovery and Protection NSE5-FORTIWEB-ADMINISTRATOR Practice Questions (Page 6)

Questions 26–30

Which FortiWeb feature is used to monitor API traffic and generate reports on API usage and security events?

Which of the following is an example of information that FortiWeb learns and stores as part of the API schema?

What is the purpose of setting a discovery scope in FortiWeb's API discovery configuration?

Keep studying — Web Application and API Security with Botnet Mitigation