Fortinet Updated NSE5_FWB_AD-8.0 Exam Questions and Answers by abeeha

Link cloaking is the FortiWeb feature designed to hide sensitive URLs or links from automated scanners and crawlers that parse HTML source code. In this scenario, the problem is not routing, encryption, or packet inspection; the problem is that bots can read embedded links directly from page content and enumerate sensitive paths such as Login, Payment, and Admin. Link cloaking helps obscure those links so that automated tools cannot easily discover them while normal users can still navigate the site as intended. URL rewriting changes URLs for routing or presentation, but it is not the most precise feature for hiding embedded links from scanners. Deep packet inspection is too broad and does not specifically solve HTML link enumeration.

When FortiWeb is deployed behind a load balancer or upstream proxy, it may see only the load balancer IP address as the source for every request. This causes poor client identification and can lead FortiWeb to block many legitimate users as if they are one abusive client. The correct fix is to preserve the original client IP address in an HTTP header, commonly using X-Forwarded-For or a similar trusted client-IP header. FortiWeb can then be configured to read that header for accurate client identification, logging, rate limiting, and IP-based security decisions. Bot detection, signature updates, and HTTPS caching do not solve the core source-IP visibility problem.

================

Traffic logging is more storage-intensive than normal event or attack logging, so FortiWeb does not always expose policy traffic-log selection by default. The Study Guide states that traffic logs must be enabled from the CLI before they can be selected in a server policy. This matches the exhibit: the administrator is in the server policy wizard but cannot see the traffic log option. FortiAnalyzer or FortiSIEM can receive logs, but they do not make the policy option appear. Deployment mode is also not the determining factor here. FortiAppSec Cloud licensing is unrelated. The correct cause is that global traffic logging must first be enabled manually through the CLI, after which policy-based traffic logging can be selected.

================