Certbie
Question 1 of 30
A financial services application, protected by FortiWeb 5.6.0, has recently deployed several highly specific custom rules to combat sophisticated SQL injection techniques. During routine monitoring, an alert is generated indicating a potential SQL injection attempt originating from a legitimate user trying to input a valid account number format that coincidentally contains a substring mirroring a malicious SQL command fragment within one of these new custom rules. This has resulted in the user being temporarily blocked. Which of the following actions is the most appropriate initial response for the FortiWeb administrator to ensure both security and user accessibility?
Analyze the specific custom rule that triggered the alert, examining its signature and logic to identify the cause of the false positive, and subsequently refine the rule or create a targeted exception to permit the legitimate user input.
Immediately disable the custom rule that generated the false positive to prevent further disruption to legitimate users, prioritizing availability over granular security.
Escalate the issue to the development team without immediate intervention, assuming the user's input is inherently problematic and requires application-level code changes.
Increase the overall aggression level of all WAF policies to catch more potential threats, accepting a higher rate of false positives as a trade-off for enhanced detection.

Preparing for NSE6FWB5.6.0 FortiWeb 5.6.0 Specialist? Now land the interview.

73% of qualified candidates get rejected because of weak resumes. Build an ATS-optimized, recruiter-ready resume in under 5 minutes - free to start.

Build My Resume Free