A travel booking website has a bot that is checking flight prices frequently, causing the site to slow down. The bot uses a legitimate user-agent and rotates IP addresses. The administrator wants to detect the bot without affecting real users. Which detection technique is most appropriate?

Signature-based detection to block the bot's user-agent.

Behavioral analysis to detect the high frequency of price checks.

Rate limiting based on IP address.

CAPTCHA challenges on the price check page.

A government website provides public information and does not require user accounts. The administrator has detected a bot that is scraping the entire site daily, consuming bandwidth. The bot is not malicious but is causing performance issues. Which mitigation action would be most appropriate without blocking legitimate public access?

Block the bot's IP addresses using signature-based detection.

Enable CAPTCHA challenges on all pages.

Implement rate limiting to restrict the number of requests per IP address.

Redirect the bot to a honeypot to waste its resources.

A healthcare portal provides patients with access to their medical records. The portal is under a bot attack that is attempting to access patient data by guessing credentials. The attack uses a distributed botnet with many IP addresses and varying user-agents. The administrator must protect patient data while ensuring that legitimate patients can access the portal, especially during peak hours. Which mitigation strategy should be implemented?

Rely solely on signature-based detection to block known bot IPs.

Implement behavioral analysis to detect abnormal login patterns, combined with rate limiting on the login endpoint.

Block all traffic from IP addresses that are not in the patient's country.

Enable CAPTCHA challenges on every login attempt.

A financial services company has noticed a bot that mimics a legitimate browser by using real user-agent strings and varying its IP addresses. The bot is scraping public data from the website. Which detection technique would be most effective in identifying this bot?

Rate limiting based on source IP address.

Behavioral analysis that monitors the rate and pattern of page requests.

Signature-based detection that matches known bot user-agent strings.

CAPTCHA challenges on every page request.

FortinetNSE 5 - FortiWeb Administrator

Domain 2Objective 3

Implement Bot Mitigation NSE5-FORTIWEB-ADMINISTRATOR Practice Questions (Page 2)

Part of the Web Application and API Security with Botnet Mitigation domain, which makes up ~34% of our current practice bank. Fortinet does not publish an official question count, but from its 65-minute exam (~25–45 total, ~9–15 in this domain), expect 3–5 from this objective — we provide 14 practice questions to prepare you well beyond it. (estimate)

14questions here

3free pages

2concepts

Questions 6–10

6application · medium
A travel booking website has a bot that is checking flight prices frequently, causing the site to slow down. The bot uses a legitimate user-agent and rotates IP addresses. The administrator wants to detect the bot without affecting real users. Which detection technique is most appropriate?
Select an answer first
7application · medium
A government website provides public information and does not require user accounts. The administrator has detected a bot that is scraping the entire site daily, consuming bandwidth. The bot is not malicious but is causing performance issues. Which mitigation action would be most appropriate without blocking legitimate public access?
Select an answer first
8expert · hard
A healthcare portal provides patients with access to their medical records. The portal is under a bot attack that is attempting to access patient data by guessing credentials. The attack uses a distributed botnet with many IP addresses and varying user-agents. The administrator must protect patient data while ensuring that legitimate patients can access the portal, especially during peak hours. Which mitigation strategy should be implemented?
Select an answer first
9application · medium
A financial services company has noticed a bot that mimics a legitimate browser by using real user-agent strings and varying its IP addresses. The bot is scraping public data from the website. Which detection technique would be most effective in identifying this bot?
Select an answer first
10foundation · easy
A FortiWeb administrator wants to detect bot traffic by comparing incoming requests against known patterns of malicious bot signatures. Which bot detection technique does this describe?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE5-FORTIWEB-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE5-FORTIWEB-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Implement Bot Mitigation NSE5-FORTIWEB-ADMINISTRATOR Practice Questions (Page 2)

Questions 6–10

A travel booking website has a bot that is checking flight prices frequently, causing the site to slow down. The bot uses a legitimate user-agent and rotates IP addresses. The administrator wants to detect the bot without affecting real users. Which detection technique is most appropriate?

A financial services company has noticed a bot that mimics a legitimate browser by using real user-agent strings and varying its IP addresses. The bot is scraping public data from the website. Which detection technique would be most effective in identifying this bot?

A FortiWeb administrator wants to detect bot traffic by comparing incoming requests against known patterns of malicious bot signatures. Which bot detection technique does this describe?

Keep studying — Web Application and API Security with Botnet Mitigation