Which UTM feature sends a UDP query to FortiGuard servers each time FortiGate scans a packet (unless the response is locally cached)?

Antivirus primarily scans files and content for known malware signatures or heuristics, not typically sending UDP queries for every packet scan to FortiGuard for categorization.

VPN (Virtual Private Network) provides secure tunnel communication and does not involve sending UDP queries to FortiGuard for packet scanning or categorization.

IPS (Intrusion Prevention System) detects and prevents known attack patterns and exploits based on signatures and anomalies, without sending UDP queries for general packet categorization.

FortiGate's Web Filtering feature, when configured to use FortiGuard services, actively queries FortiGuard servers via UDP for URL categorization to determine access policies, with responses being cached locally to reduce subsequent lookups.