Discuss Fortinet NSE5_FWB_AD-8.0 Exam Topic 3 Question 2

A third-party penetration test reveals that users can bypass login controls through a mobile API. Your current FortiWeb configuration includes zero trust network access (ZTNA) profiles and cookie security, but API protection and client management are not enabled. The security team asks you to recommend the most effective way to close this gap.

Which FortiWeb adjustment would best prevent future unauthorized API access?

ASwitch to a reverse-proxy mode to bypass cookie-based controls.

BEnable API protection and client management to enforce identity checks on mobile API traffic.

CReplace ZTNA with bot protection to reduce false positives.

DLog only API traffic and rely on FortiAnalyzer for future alerts.

Suggested Answer: B

The issue is unauthorized access through a mobile API, so the control must enforce API-specific identity and access rules. FortiWeb API protection can validate API structure, methods, paths, and authorization requirements, while client management can help associate requests with legitimate clients or authenticated users. ZTNA profiles and cookie security can help with access and session protection, but they do not replace API-specific authorization controls. Switching reverse-proxy mode to bypass cookie controls makes no sense and could weaken protection. Replacing ZTNA with bot protection addresses a different problem: automation, not API authorization. Logging only records activity after the fact and does not prevent bypass. The correct action is to enable API protection and client management for mobile API traffic.

================

Get Premium NSE5_FWB_AD-8.0 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Elena 2 months ago

Option A seems risky. B is definitely more secure.

Hortencia 2 months ago

Agreed! Enabling client management helps with identity checks.

Christoper 2 months ago

I think option B is the best choice. API protection is crucial.

Latrice 2 months ago

Agreed, B is the way to go for proper identity checks!

Kenneth 2 months ago

D seems risky, just logging traffic won’t stop the issue.

Clay 2 months ago

Wow, I can’t believe they didn’t have API protection enabled!

Willow 3 months ago

I’m not so sure about that, A could work too.

Velda 3 months ago

Definitely B, we need to enable API protection for sure.

Desire 3 months ago

Logging only API traffic seems like a bad idea. I recall a practice question where we learned that relying solely on logs can lead to missed threats.

Joaquin 3 months ago

I feel like client management is crucial here too, especially since we’re dealing with mobile APIs. It might help enforce those identity checks.

Bettina 3 months ago

I'm not entirely sure, but switching to reverse-proxy mode sounds risky. I think it might complicate things instead of helping.

Laquita 4 months ago

I remember discussing API protection in class, and it seems like enabling that would directly address the issue of unauthorized access.

Fortinet NSE5_FWB_AD-8.0 Exam - Topic 3 Question 2 Discussion