Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Fortinet Certified Professional: FortiGate / FortiOS 7.6 Administrator · Fortinet
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Correct: A. The flow-based inspection is used, which resets the last packet to the user.
A is coreect
Study Guide - Antivirus - Antivirus Scanning Modes - Flow-Based Inspection Mode. Two possible scenarios can occur when a virus is detected: - When a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FG resets the connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that IF A SECOND ATTEMPT TO TRANSMIT THE FILE IS MADE, THE IPS ENGINE WILL SEND A BLOCK REPLACEMENT MESSAGE to the client instead of scanning the file again. - If the virus is detected at the start of the connection, the IPS engine sends the block replacement message immediately.