A security consultant decides to use multiple layers of anti-virus defense, such as end user desktop anti- virus and E-mail gateway. This approach can be used to mitigate which kind of attack?

Forensic attacks relate to post-incident investigation techniques, not an attack vector that anti-virus layering would mitigate.

ARP spoofing is a network-layer attack targeting address resolution and is countered by dynamic ARP inspection or network controls, not anti-virus software.

Social engineering attacks frequently use phishing emails with malicious attachments or links to trick users into executing malware. Deploying anti-virus at both the email gateway (to block malicious content before it reaches the user) and the endpoint (to catch anything that slips through) creates a defense-in-depth strategy specifically effective against this vector.

Scanning attacks involve network reconnaissance and are mitigated by firewalls and IDS/IPS, not anti-virus solutions.