What does the 'Action' field in an antivirus log entry indicate?

The name of the antivirus profile that detected the virus.

The protocol used for the infected traffic.

The severity level of the detected virus.

The action taken by the FortiGate, such as 'blocked' or 'monitored'.

What is a primary advantage of proxy-based antivirus inspection over flow-based inspection?

Proxy-based inspection provides deeper inspection of the entire file before it is forwarded to the client.

Proxy-based inspection can detect viruses in files that are larger than the FortiGate's memory.

Proxy-based inspection is the only mode that can scan HTTPS traffic.

Proxy-based inspection uses less CPU because it does not need to reassemble packets.

An organization is experiencing high CPU usage on their FortiGate during peak hours. They have antivirus scanning enabled in proxy mode for all HTTP traffic. They want to reduce the performance impact without sacrificing malware protection. What should they do?

Increase the 'Maximum scan size' to allow more files to be scanned.

Switch the antivirus inspection mode to flow-based for HTTP traffic.

Disable antivirus scanning for HTTP and rely on the firewall's IPS.

Enable 'Scan files on-the-fly' in the proxy profile.

Which FortiGate tool is used to view real-time antivirus event logs?

The 'FortiView' > 'Threats' page.

The 'Log & Report' > 'Antivirus' page.

The 'Log & Report' > 'Event Log' page.

A security team wants to be alerted when antivirus detects malware on their network. They have configured an antivirus profile with logging enabled, but they are not receiving alerts. What should they configure to ensure they are notified of detections?

Set the antivirus action to 'Block' instead of 'Monitor'.

Enable 'Log all traffic' in the firewall policy.

Use the 'get antivirus status' command to check for detections.

Configure an alert email or syslog server to receive antivirus event logs.

FortinetNSE 4 - FortiOS 7.6 Administrator

Domain 3Objective 4

Configure Antivirus Scanning Modes to Neutralize Malware Threats NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 4)

Part of the Content Inspection domain, which accounts for 25-30% of the NSE4-FORTIOS-ADMINISTRATOR exam. Fortinet does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–18 in this domain), expect 2–4 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

7concepts

25-30%of the exam

Questions 16–20

16foundation · easy
What does the 'Action' field in an antivirus log entry indicate?
Select an answer first
17foundation · easy
What is a primary advantage of proxy-based antivirus inspection over flow-based inspection?
Select an answer first
18application · medium
An organization is experiencing high CPU usage on their FortiGate during peak hours. They have antivirus scanning enabled in proxy mode for all HTTP traffic. They want to reduce the performance impact without sacrificing malware protection. What should they do?
Select an answer first
19foundation · easy
Which FortiGate tool is used to view real-time antivirus event logs?
Select an answer first
20application · medium
A security team wants to be alerted when antivirus detects malware on their network. They have configured an antivirus profile with logging enabled, but they are not receiving alerts. What should they configure to ensure they are notified of detections?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE4-FORTIOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE4-FORTIOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.