Drag and Drop Question
Refer to the exhibit.

You are reviewing the FortiWeb integration with the Advanced Bot Protection (ABP) service.
Match each step in the ABP flow with its description.
Select the step in the left column, hold and drag it to a blank position in the column on the right.
Place the six correct steps in order, placing the first step in the position which is labeled as step 1.
Once you place a step, you can move it again if you want to change your answer before moving to the next question. You need to drop six steps in the work area.
Select and drag the screen divider to change the viewable area of the source and work areas.

Drag and Drop Question
A FortiWeb administrator is reviewing protection effectiveness after a surge in malicious traffic exposed design flaws and misconfigurations in several web applications.
For each Open Web Application Security Project (OWASP) risk listed, choose the FortiWeb feature that offers the most strategic protection, considering both coverage depth and operational effectiveness.
Match the most appropriate FortiWeb feature to each OWASP issue.
Select each FortiWeb feature in the left column, hold and drag it to the blank space next to the OWASP issue in the column on the right. Once you match a FortiWeb feature to the OWASP issue, you can move it again if you want to change your answer by clicking on the FortiWeb feature. You need to match five FortiWeb features to the OWASP issue in the work area.

Which feature allows FortiWeb to inspect and enforce policy on API traffic that uses JSON or XML payloads, including schema validation?

• A. Cookie poisoning detection
• B. API protection / API gateway features
• C. Web anti-defacement
• D. WCCP mode

A FortiWeb administrator needs to allow a known web indexer to scan the website for search engine visibility. What is the easiest way to allow this on FortiWeb?

• A. Add the web indexer IP address to the FortiGuard Known Search Engines category.
• B. Add the web indexer user-agent string to a custom signature exemption rule.
• C. Add the web indexer IP address to an IP exception list inside the inline protection profile.
• D. Add the web indexer IP address to the trusted IP address list.

Refer to the exhibit.

You are a FortiWeb administrator reviewing the biometrics-based detection rule shown in the exhibit.
Your goal is to configure a rule that detects bots that avoid typical human interactions like using a mouse or clicking. You also want to log the detection event and apply a high-severity alert.
Based on the current configuration, which settings should you change to meet this goal?

• A. Select Screen Touch and Page Focus, set the severity to Low, and keep action as Deny (no log).
• B. Do not select any client events to monitor, enable Bot Trait Checking, keep the current severity, and keep the action as Deny (no log).
• C. Select Keyboard and Scroll, change the action to Alert, and set the severity to High.
• D. Select Mouse Movement and Click, change the action to Alert, and set the severity to High.