nerdexam
Fortinet

NSE4 · Question #349

Which statements about antivirus scanning using flow-based full scan are true? (Choose two.)

The correct answer is A. The antivirus engine starts scanning a file after the last packet arrives. C. FortiGate can insert the block replacement page during the first connection attempt only if a virus. Flow-based full antivirus scanning initiates after the complete file is received, allowing the FortiGate to insert a block replacement page upon detecting a virus.

Submitted by alyssa_d· Apr 18, 2026Security Profiles and Content Inspection

Question

Which statements about antivirus scanning using flow-based full scan are true? (Choose two.)

Options

  • AThe antivirus engine starts scanning a file after the last packet arrives.
  • BIt does not support FortiSandbox inspection.
  • CFortiGate can insert the block replacement page during the first connection attempt only if a virus
  • DIt uses the compact antivirus database.

How the community answered

(48 responses)
  • A
    77% (37)
  • B
    6% (3)
  • D
    17% (8)

Why each option

Flow-based full antivirus scanning initiates after the complete file is received, allowing the FortiGate to insert a block replacement page upon detecting a virus.

AThe antivirus engine starts scanning a file after the last packet arrives.Correct

In flow-based full scan mode, the FortiGate buffers the entire file and reassembles it before the antivirus engine begins scanning for threats, ensuring a complete file analysis.

BIt does not support FortiSandbox inspection.

Flow-based inspection, including full scan antivirus, fully supports integration with FortiSandbox for advanced threat analysis and sandboxing of suspicious files.

CFortiGate can insert the block replacement page during the first connection attempt only if a virusCorrect

When a virus is detected during a flow-based full scan, the FortiGate can immediately block the malicious content and send a customizable replacement page to the client, preventing further transmission of the infected file.

DIt uses the compact antivirus database.

Flow-based full antivirus scanning typically utilizes the standard or extended antivirus database, which contains a broader range of signatures, rather than the compact database.

Concept tested: FortiGate flow-based AV scanning

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/572886/antivirus-scan-modes

Topics

#Antivirus (AV)#Flow-based Inspection#Full Scan#Replacement Pages

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice