Which antivirus inspection mode must be used to scan SMTP, FTP, POP3 and SMB protocols?

While proxy-based inspection offers deeper scanning, flow-based is the more commonly cited and efficient mode for scanning streaming protocols like SMTP, FTP, POP3, and SMB.

DNS-based inspection is not an antivirus inspection mode; it relates to DNS filtering or security features that leverage DNS.

Flow-based inspection is designed for scanning protocols such as SMTP, FTP, POP3, and SMB, where the FortiGate reassembles the traffic flow to perform antivirus scanning as data streams through, offering a balance between performance and security for these specific protocols.

Man-in-the-middle (MITM) is a technique often associated with SSL/TLS inspection, not a general antivirus inspection mode for the listed clear-text protocols.