Implement Web Vulnerability Scans NSE5-FORTIWEB-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An e-commerce company needs to run a vulnerability scan on its payment processing page. The page is protected by a Web Application Firewall (WAF) that blocks malicious requests. The scan must be able to identify vulnerabilities without being blocked by the WAF. What should the administrator configure in FortiWeb?

   • AConfigure the scan to use the 'Passive' attack logic to avoid triggering WAF rules.
   • BAdd the scanner's IP address to the WAF's allowlist and configure the scan to use a custom User-Agent.
   • CRun the scan from a different network segment to bypass the WAF.
   • DDisable the WAF during the scan and re-enable it after the scan completes.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company runs a vulnerability scan on its web application every night. The scan takes about 45 minutes to complete. The administrator notices that the scan sometimes overlaps with the application's backup window, which causes performance issues. What should the administrator do to resolve this?

   • ARun the scan manually instead of on a schedule.
   • BAdjust the scan schedule to start after the backup window ends.
   • CChange the scan profile to a less thorough one to reduce scan time.
   • DDisable the backup window to allow the scan to run uninterrupted.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a web application that is subject to PCI DSS compliance. The compliance team requires that a vulnerability scan be run quarterly, and the results must be reviewed and remediated. The last scan found several 'High' severity vulnerabilities, but the development team has not fixed them yet. The next quarterly scan is due in two weeks. What should the administrator do?

   • ADelay the scan until the development team fixes the high-severity vulnerabilities.
   • BRun the quarterly scan as scheduled and document the unresolved high-severity vulnerabilities in the compliance report.
   • CRun the scan and automatically apply virtual patches to fix the vulnerabilities.
   • DRun the scan but exclude the high-severity vulnerabilities from the report to avoid compliance issues.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A vulnerability scan report shows a 'Low' severity finding for 'Clickjacking' on a web page. The page does not contain any sensitive functionality. The administrator needs to decide whether to remediate the finding. What should the administrator consider?

   • AThe finding should be re-scanned with a more aggressive profile.
   • BThe finding should be ignored because it is only rated 'Low' severity.
   • CThe finding should be remediated because clickjacking can be exploited to trick users into unintended actions.
   • DThe finding can be accepted as a low risk because the page does not contain sensitive functionality.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After running a vulnerability scan on a web application, the FortiWeb report shows a 'High' severity SQL injection finding on the login page and a 'Medium' severity cross-site scripting (XSS) finding on the search results page. The development team has limited resources and can only fix one issue this sprint. Based on the scan report, which remediation should the administrator prioritize?

   • AFix both vulnerabilities simultaneously because they are both security risks.
   • BRe-run the scan to confirm both findings before taking any action.
   • CFix the SQL injection vulnerability first because it has a higher severity rating and could allow direct database compromise.
   • DFix the XSS vulnerability first because it is easier to exploit and affects all users.
   Reveal Solution Discussion Select an answer first