NSE4_FGT Question 89

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose BDE1

  Correct: B. Flow-based inspection uses a hybrid of scanning modes available in proxy-based inspection. D. Optimized performance compared to proxy-based inspection. E. FortiGate buffers the whole file but transmits to the client simultaneously. Incorrect: A. IPS engine handles the process as a standalone C. If the virus is detected, the last packet is delivered to the client. FortiGate Security 7.2 Study Guide (p.350): "Flow-based inspection mode uses a hybrid of the scanning modes available in proxy-based inspection" "If performance is your top priority, then flow inspection mode is more appropriate" "As you can see on this slide, the client sends a request and starts receiving packets immediately, but FortiGate also caches those packets at the same time." Reference and download study guide: https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html

• 1

  Isnt the last packet sent in Flow-based still, even though it is messed with? Wouldnt this make C correct as well?

• 1

  Nope, C is not correct. "When a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FortiGate resets the connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened."