Implement Web Vulnerability Scans NSE5-FORTIWEB-ADMINISTRATOR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A vulnerability scan report shows a 'Medium' severity finding for 'Directory Traversal' on a web server. The administrator checks the application code and confirms that user input is properly sanitized. What should the administrator do next?

   • ARe-run the scan with a more aggressive profile to confirm the finding.
   • BMark the finding as a false positive in the scan report and document the verification.
   • CIgnore the finding because it is only rated 'Medium' severity.
   • DImmediately patch the web server to fix the directory traversal vulnerability.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company runs a vulnerability scan on its web application and the report shows a 'Critical' severity finding for 'Remote Code Execution (RCE)'. The application is a legacy system that cannot be patched immediately. The administrator needs to mitigate the risk while a permanent fix is developed. What should the administrator do?

   • ARe-run the scan to confirm the finding before taking any action.
   • BDisable the application until the permanent fix is available.
   • CIgnore the finding because the application is legacy and not exposed to the internet.
   • DUse FortiWeb's virtual patching feature to block exploit attempts while the permanent fix is developed.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has a web application that uses a third-party API for payment processing. The security team wants to run a vulnerability scan that includes testing the API integration. What should the administrator configure in FortiWeb?

   • AUse the same scan profile for the API as for the main application.
   • BScan only the main web application and assume the API is secure.
   • CDisable the API during the scan to avoid false positives.
   • DAdd the API endpoint as a separate scan target with appropriate authentication credentials.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A FortiWeb administrator needs to run a web vulnerability scan against a specific web application. What must be configured in the scan configuration to define the application to be tested?

   • AA scan schedule
   • BA scan profile
   • CA scan report
   • DA scan target
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A FortiWeb administrator is reviewing a scan report and notices that a 'SQL Injection' finding is marked as 'Confirmed' but the affected parameter is not used in any database query. The developer confirms the parameter is only used for logging. What should the administrator conclude?

   • AThe finding should be remediated anyway because the scanner is reliable.
   • BThe finding is a false positive because the parameter is not used in a database query.
   • CThe finding should be re-scanned with a different profile to confirm.
   • DThe finding is valid because the scanner confirmed it.
   Reveal Solution Discussion Select an answer first