NSE 4 – FortiGate 6.4 — Question 76

Which two statements about antivirus scanning mode are true? (Choose two.)

Answer options

• A. In flow-based inspection mode, FortiGate buffers the file, but also simultaneously transmits it to the client
• B. In proxy-based inspection mode, antivirus scanning buffers the whole file for scanning, before sending it to the client
• C. In proxy-based inspection mode, files bigger than the buffer size are scanned
• D. In flow-based inspection mode, files bigger than the buffer size are scanned

Correct answer: A, B

Explanation

Option A is correct because flow-based inspection allows FortiGate to both buffer and transmit files at the same time. Option B is also correct as proxy-based inspection requires the entire file to be buffered for scanning before it's sent to the client. Options C and D are incorrect because, in proxy-based mode, files larger than the buffer size cannot be scanned, and the same applies to flow-based mode.