Configure Antivirus Scanning Modes to Neutralize Malware Threats NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which statement correctly describes a key difference between flow-based and proxy-based antivirus inspection on FortiGate?

   • AFlow-based inspection can scan protocols that proxy-based inspection cannot, such as IMAP and POP3.
   • BProxy-based inspection is always faster than flow-based because it does not need to buffer files.
   • CFlow-based inspection buffers the entire file before scanning, while proxy-based inspection scans data as it streams.
   • DFlow-based inspection uses the FortiGate's security processing unit (SPU) for accelerated scanning, while proxy-based inspection relies on the CPU and buffers files.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization is required to inspect email traffic for malware before it reaches user mailboxes. They have configured a proxy-based antivirus profile and applied it to the SMTP protocol. However, they notice that some emails with large attachments are not being scanned. What is the most likely reason, and what should they do?

   • AThe antivirus profile is not applied to the correct firewall policy. Reapply it to the SMTP policy.
   • BThe SMTP protocol is not supported in proxy mode. Use IMAP instead.
   • CThe FortiGate's antivirus database is outdated. Update the AV signatures.
   • DThe 'Oversize file' action is set to 'Pass', so large attachments bypass scanning. Change it to 'Block' or 'Log'.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is experiencing performance degradation on their FortiGate during peak hours. They have antivirus scanning enabled in proxy mode for all HTTP and FTP traffic. They also have a requirement to block malware in real-time. They are considering switching to flow mode to improve performance. What is the most important trade-off they should consider?

   • AFlow mode requires more memory than proxy mode, which could worsen performance.
   • BFlow mode does not support antivirus logging, so they would lose detection logs.
   • CFlow mode may not detect some malware that proxy mode would catch, due to differences in scanning capabilities.
   • DFlow mode cannot scan FTP traffic, so they would need to keep proxy mode for FTP.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which protocol-specific option is available in a proxy-based antivirus profile but not in a flow-based profile?

   • AThe ability to set a maximum file size for scanning.
   • BThe ability to configure 'Chunked' transfer handling for HTTP.
   • CThe ability to scan email attachments in SMTP.
   • DThe ability to scan FTP uploads and downloads.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses a proxy-based antivirus profile to scan POP3 email traffic. They have noticed that some emails are being delayed, and users are complaining about slow email delivery. What can the administrator do to reduce the delay while still scanning for malware?

   • AReduce the 'Maximum scan size' to limit the size of files that are scanned.
   • BIncrease the 'Buffer size' in the proxy profile to speed up scanning.
   • CEnable 'Scan files on-the-fly' in the proxy profile.
   • DSwitch to flow-based inspection for POP3 traffic.
   Reveal Solution Discussion Select an answer first