When using the predefined default antivirus profile, the policy will inspect for viruses on the decoders. Match each decoder with its default action. Answer options may be used more than once or not…

Question

Options

• AIMAP - Alert
• BIMAP - Reset-both
• CHTTP - Alert
• DHTTP - Reset-both
• EFTP, SMB - Alert
• FFTP, SMB - Reset-both
• GPOP3, SMTP - Alert
• HPOP3, SMTP - Reset-both

• A
  87% (34)
• C
  3% (1)
• E
  3% (1)
• H
  8% (3)

Explanation

In FortiGate's predefined default antivirus profile, the action assigned to each decoder depends on the protocol type: email protocols (IMAP, POP3, SMTP) default to Alert, while file-transfer/web protocols (HTTP, FTP, SMB) default to Reset-both. Email protocols use Alert because they are store-and-forward - the session cannot be meaningfully "reset" mid-delivery, so the threat is logged and an alert is raised instead. HTTP, FTP, and SMB use Reset-both because these are interactive/streaming protocols where the connection can be terminated immediately on both sides to block malware delivery.

Why the distractors are wrong:

• B (IMAP - Reset-both): IMAP is an email protocol, so Alert applies, not Reset-both.
• C (HTTP - Alert): HTTP is a streaming protocol; Reset-both is the correct action, not Alert.
• E (FTP, SMB - Alert): FTP and SMB are file-transfer protocols; they receive Reset-both, not Alert.
• H (POP3, SMTP - Reset-both): POP3 and SMTP are email protocols, so Alert applies, not Reset-both.

Memory tip: Think "Email = Alert, Everything else = Reset" - email protocols (IMAP, POP3, SMTP) can only alert since you can't abort a mid-flight message, but HTTP/FTP/SMB sessions can be hard-stopped, so they get Reset-both.

No community discussion yet for this question.