Which three security features must you configure on FortiWeb to protect API connections? (Choose three.)

FortiWeb provides a multi-layered approach to secure API connections. The three essential features are:

1. API Schema Validation: This enforces a positive security model by validating all incoming API requests against a predefined OpenAPI or Swagger schema. It ensures that requests adhere to the correct format, data types, and constraints, effectively blocking malformed or malicious payloads.

2. Machine Learning (ML)-based API Protection: FortiWeb uses machine learning to automatically build a model of normal API traffic. It then uses this model to detect anomalous behavior, business logic abuse, and zero-day attacks that static rules or signatures might miss.

3. API User Key Enforcement: This is a fundamental access control mechanism. By requiring and validating API keys, FortiWeb ensures that only authorized clients can access the API endpoints, preventing unauthorized usage.

A. Single sign-on (SSO) authentication with Active Directory (AD): This is an authentication method for human users accessing web applications via a browser, not a typical security control for machine-to-machine API communication.

D. API user authentication with SAML: SAML is primarily a standard for web browser single sign-on (SSO). While it can be adapted for APIs, it is not a common or foundational security feature for them, unlike API keys or OAuth.

1. FortiWeb 7.4.0 Administration Guide

Page 518

"API Protection": "FortiWeb's API protection feature allows you to import an OpenAPI file that defines the specifications of your APIs. FortiWeb then validates the API requests against the specifications defined in the OpenAPI file." (Supports option C)

2. FortiWeb 7.4.0 Administration Guide

Page 488

"Machine Learning": "FortiWeb uses machine learning to detect attacks based on abnormal user behavior... It can be applied to both regular web applications and APIs to detect threats." (Supports option B)

3. FortiWeb 7.4.0 Administration Guide

Page 520

"API Protection > API": The configuration for API protection includes settings for authentication and authorization

which are the mechanisms used to enforce access control

commonly through methods like API keys. The guide states

"FortiWeb validates the API requests against the specifications defined in the OpenAPI file

including the security schemes

such as API Key

HTTP authentication

and OAuth 2.0." (Supports option E)