Configure API Discovery and Protection NSE5-FORTIWEB-ADMINISTRATOR Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   When FortiWeb lists discovered API endpoints, which of the following is typically included in that list?

   • AThe database queries executed by the API
   • BThe URL path and the HTTP methods allowed on that path
   • CThe source IP addresses of all API consumers
   • DThe TLS certificate serial numbers used by the API
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following can be configured when setting up API discovery in FortiWeb?

   • AThe brand of the API client devices
   • BThe email address of the API administrator
   • CThe physical location of the API servers
   • DThe schedule for when discovery runs
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A compliance officer at a bank requires a monthly report showing all API security events, including blocked injection attempts and authentication failures, for audit purposes. The administrator needs to generate this report from FortiWeb. What should the administrator do?

   • AEnable API discovery to log all API traffic
   • BConfigure API gateway mode to route traffic to a third-party SIEM
   • CCreate a custom report using FortiWeb's logging and analytics features, filtering for security events
   • DApply a stricter API protection policy to reduce the number of security events
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is an example of an API protection policy that can be applied in FortiWeb?

   • ARewriting the API's source code
   • BChanging the API's HTTP method from GET to POST
   • CRate limiting to control the number of requests per client
   • DDeleting unused API endpoints automatically
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is using FortiWeb as an API gateway for multiple backend services. The /auth endpoint must be accessible without authentication, while all other endpoints require a valid JWT. The administrator wants to enforce this consistently. What should the administrator configure?

   • ACreate an API protection policy that allows unauthenticated access to /auth and requires JWT validation for all other paths
   • BEnable API gateway mode and configure routing rules for each backend service
   • CConfigure rate limiting on the /auth endpoint to prevent abuse
   • DEnable API discovery to learn the authentication requirements of each endpoint
   Reveal Solution Discussion Select an answer first