The scenario describes distributed scraping where each individual IP stays below request-rate thresholds. A simple DoS threshold is weak here because the attacker avoids volume-based detection per source. Static blocklists are also ineffective because many botnet IPs may appear only once or rotate frequently. Blocking every non-allowlisted user agent would cause severe false positives and is easy for bots to evade by spoofing headers. FortiWeb bot mitigation is the correct control because it can evaluate behavior beyond source IP volume. Device fingerprinting, browser behavior, headers, JavaScript challenges, and client characteristics help correlate suspicious automation even when requests are spread across many addresses. Therefore, bot mitigation with behavioral/device fingerprinting is the strongest answer.

================

The exhibit is written in structured OpenAPI/YAML-style format. It includes fields such as info, version, title, servers, paths, HTTP method get, operationId, responses, content type application/json, and a schema definition. That is not HTML and it is not a live API response. It is also not CLI output from FortiWeb. FortiWeb OpenAPI validation uses OpenAPI description files in YAML or JSON to define API structure, endpoints, parameters, and expected data types. FortiWeb then uses that uploaded schema as a baseline to validate API requests and block requests that do not conform. So the exhibit is best identified as an API schema file

Option D is the strongest SQL injection example because it uses SQL syntax with a comment marker -- to neutralize the password condition. In a vulnerable login query, that could cause the database to evaluate only the username portion and ignore the password check, creating an authentication bypass. Option C is not SQL injection; it is cross-site scripting because it executes JavaScript in the browser. Option B is fake XML-like markup and not a realistic SQL payload. Option A contains a SQL-like subquery, but it is not the best authentication-bypass pattern shown. FortiWeb’s injection defenses are designed to detect SQL injection and XSS as malicious input patterns targeting application logic.

================

When FortiWeb is deployed behind a load balancer or upstream proxy, it may see only the load balancer IP address as the source for every request. This causes poor client identification and can lead FortiWeb to block many legitimate users as if they are one abusive client. The correct fix is to preserve the original client IP address in an HTTP header, commonly using X-Forwarded-For or a similar trusted client-IP header. FortiWeb can then be configured to read that header for accurate client identification, logging, rate limiting, and IP-based security decisions. Bot detection, signature updates, and HTTPS caching do not solve the core source-IP visibility problem.

================

Automatic HTTP-to-HTTPS redirection should be enabled when users must be forced onto encrypted communication, especially for applications that process logins, credentials, payment data, personal data, or other sensitive information. HTTP sends traffic without transport encryption, which exposes users to interception, credential theft, session hijacking, and downgrade-style risk. FortiWeb can redirect HTTP requests to HTTPS so users who type or follow an insecure HTTP URL are automatically moved to the secure version of the application. Keeping both HTTP and HTTPS available for flexibility weakens security. Static sites without sensitive data may not require this control. A back-end server using only HTTP is a separate SSL offloading design issue and does not justify leaving client-side traffic unencrypted.

SSRF is an application-layer abuse case where attacker-controlled input causes the backend application to make unintended server-side requests. FortiWeb controls such as parameter validation, file security, and ML anomaly detection reduce risk, but SSRF often succeeds when the application accepts weakly validated URLs, hostnames, redirects, metadata endpoints, internal IP ranges, or backend-only resources. Disabling ML would weaken protection. Moving SSRF protection to FortiGate is wrong because SSRF depends on HTTP/API logic, not only network-layer filtering. HTTPS inspection alone does not solve unsafe backend request behavior. The correct priority is to refine input validation and filtering logic so FortiWeb can better detect and block malicious URL, parameter, and backend-request patterns.

================

The FortiGate is acting as an upstream reverse proxy, so FortiWeb sees the FortiGate address as the direct source IP unless it is configured to read the original client IP from the inserted HTTP header. Since FortiGate already inserts X-Forwarded-For, the proper fix is to modify the FortiWeb protection profile or related client-IP configuration so FortiWeb uses that header for client IP detection. This restores accurate logging, rate limiting, reputation checks, and IP-based enforcement. Changing to one-arm proxy is unnecessary and disruptive. Disabling IP-based detection weakens protection instead of fixing attribution. Recreating the policy with a predefined profile does not address the missing client IP mapping. The correct adjustment is to trust and use X-Forwarded-For.

FortiWeb machine learning protection depends on observed application traffic. The administrator must first collect traffic samples so FortiWeb can learn normal behavior and create a useful baseline. After sample collection, FortiWeb uses the collected data to build the detection model. Once the model is built, it must be enabled or run in the live environment so FortiWeb can evaluate production requests and detect abnormal or bot-like behavior. Manual verification on test data only is not enough to activate the model for real traffic. Bayesian analysis is not the FortiWeb configuration step shown for this process; the platform handles model logic internally. The practical workflow is collection, model building, and live enforcement or detection.

================

FortiWeb bot mitigation separates malicious bots from useful bots such as legitimate search engine crawlers. The FortiGuard Known Search Engines category is designed for this exact use case: allowing recognized search engines to crawl and index protected websites without being treated as hostile automation. Adding a source IP to a general trusted IP list may allow the crawler, but it is broader than necessary because it can bypass more protections than intended. An inline profile exception is more manual and less clean. User-agent exceptions are weak because user-agent strings are easy to spoof. The best FortiWeb-native approach is to use the known search engine handling within bot mitigation so legitimate indexing remains available while malicious bots remain controlled.

================

The goal is to detect bots that avoid normal human interaction, specifically mouse use and clicking, while logging the event and treating it as high severity. In FortiWeb biometrics-based bot detection, monitored client events such as mouse movement, click, keyboard, screen touch, page focus, and scroll help FortiWeb distinguish human behavior from automated behavior. Since the question specifically mentions mouse and clicking, the correct monitored events are Mouse Movement and Click . The current action is Deny (no log) , which would not meet the logging requirement. Changing the action to Alert logs the event instead of silently denying it, and setting severity to High aligns with the requirement for a high-severity alert.

================