A firewall policy has been configured for the internal email server to receive email from external parties through SMTP. Exhibits A and B show the antivirus and email filter profiles applied to this…

Standard FortiGate antivirus behavior for email attachments, when configured to 'Remove' or 'Strip', is to remove the malicious file from the email and then allow the cleaned email to be delivered to the recipient, often with a replacement message informing them of the file's removal.

Rejecting the entire infected email and notifying the sender is an action typically reserved for spam or specific content filtering, not the default or primary action for virus-infected attachments where cleaning is possible.

While the FortiGate removes the infected file and adds a replacement message, the replacement message is typically for the recipient and for internal logging, not usually sent back to the original sender.

Rejecting the entire infected email is not the primary action for an attachment virus unless explicitly configured, as the goal is usually to deliver the clean email, and sender notification regarding a replacement message is not standard.