Configure Antivirus Scanning Modes to Neutralize Malware Threats NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In a proxy-based antivirus profile on FortiGate, what does the 'Buffer' setting control?

   • AThe number of files that can be scanned simultaneously.
   • BThe amount of memory allocated for the antivirus engine.
   • CThe maximum amount of data that is buffered before scanning begins.
   • DThe maximum size of files that can be scanned without buffering.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a common cause of false positives in antivirus scanning?

   • AThe antivirus engine detects a legitimate file as malicious due to heuristic analysis.
   • BThe file is corrupted and cannot be scanned.
   • CThe antivirus database is outdated.
   • DThe FortiGate has insufficient memory to buffer files.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company has been using a flow-based antivirus profile for HTTP traffic. They have started receiving complaints from users that some legitimate files are being blocked. Upon investigation, they find that the files are being flagged as malware. What is the most likely cause and what should they do?

   • AThe files are actually infected, and the users are mistaken. No action is needed.
   • BThe antivirus profile is set to 'Monitor' mode, which blocks files. Change it to 'Block'.
   • CThe antivirus signatures are outdated, causing false positives. Update the AV database.
   • DThe heuristic detection is too aggressive, causing false positives. Adjust the heuristic sensitivity or add an exception.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company uses a proxy-based antivirus profile to scan FTP traffic. They have noticed that some files are being blocked even though they are not infected. The files are large and the users need them for their work. What should the administrator do to resolve this issue while maintaining security?

   • ASwitch to flow mode for FTP scanning to avoid the issue.
   • BDisable antivirus scanning for FTP traffic.
   • CChange the 'Oversize file' action to 'Pass' to allow large files through without scanning.
   • DIncrease the 'Maximum scan size' in the antivirus profile to accommodate the large files.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which configuration step is required to apply an antivirus profile in flow-based inspection on a FortiGate?

   • AEnable the antivirus profile in the firewall policy's security profiles.
   • BSet the firewall policy's inspection mode to proxy-based.
   • CConfigure the antivirus profile under 'System > Feature Visibility'.
   • DCreate a separate VDOM for antivirus scanning.
   Reveal Solution Discussion Select an answer first