The provided screenshot displays the Machine Learning (ML) configuration on a FortiWeb appliance. The Phase is explicitly set to Running, and the Sample Per IP parameter is set to Unlimited. This configuration instructs FortiWeb, during its operational Running phase, to continuously accept and process an unlimited number of traffic samples from any single source IP address. This allows the ML engine to perpetually refine its model of normal traffic behavior without being constrained by a sample limit per IP.

A. This is incorrect because the Sample Per IP setting is explicitly configured as Unlimited, not a fixed or "set number".

C. This is incorrect because the screenshot clearly shows the ML Phase is set to Running, not collecting.

D. This is incorrect as the Phase is Running, not collecting, and the configuration allows for Unlimited samples, not zero.

1. FortiWeb Administration Guide 7.4.1

Page 580

Section: "Configuring machine learning".

The guide details the configuration options for Machine Learning. It lists Running as a selectable Phase. It also describes the Sample Per IP setting

stating: "Select the maximum number of samples that FortiWeb collects from the same source IP address. The available options are 100

1000

10000

and Unlimited." The screenshot shows these two settings configured as Running and Unlimited

directly supporting the correct answer.

2. FortiWeb Cookbook 7.4.0

Page 113

Section: "Machine Learning for anomaly detection".

This document explains the ML process: "In the running phase

FortiWeb uses the data it has collected to build a mathematical model of your application's valid traffic. It then compares new traffic to the model to detect requests that are anomalous." The continuous learning in the running phase is governed by the sampling parameters

which in this case are set to unlimited per IP.