NSE4 · Question #349
Which statements about antivirus scanning using flow-based full scan are true? (Choose two.)
The correct answer is A. The antivirus engine starts scanning a file after the last packet arrives. C. FortiGate can insert the block replacement page during the first connection attempt only if a virus. Flow-based full antivirus scanning initiates after the complete file is received, allowing the FortiGate to insert a block replacement page upon detecting a virus.
Question
Which statements about antivirus scanning using flow-based full scan are true? (Choose two.)
Options
- AThe antivirus engine starts scanning a file after the last packet arrives.
- BIt does not support FortiSandbox inspection.
- CFortiGate can insert the block replacement page during the first connection attempt only if a virus
- DIt uses the compact antivirus database.
How the community answered
(48 responses)- A77% (37)
- B6% (3)
- D17% (8)
Why each option
Flow-based full antivirus scanning initiates after the complete file is received, allowing the FortiGate to insert a block replacement page upon detecting a virus.
In flow-based full scan mode, the FortiGate buffers the entire file and reassembles it before the antivirus engine begins scanning for threats, ensuring a complete file analysis.
Flow-based inspection, including full scan antivirus, fully supports integration with FortiSandbox for advanced threat analysis and sandboxing of suspicious files.
When a virus is detected during a flow-based full scan, the FortiGate can immediately block the malicious content and send a customizable replacement page to the client, preventing further transmission of the infected file.
Flow-based full antivirus scanning typically utilizes the standard or extended antivirus database, which contains a broader range of signatures, rather than the compact database.
Concept tested: FortiGate flow-based AV scanning
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/572886/antivirus-scan-modes
Topics
Community Discussion
No community discussion yet for this question.