Which three statements explain a flow-based antivirus profile? (Choose three.)

Flow-based antivirus inspection is designed for high performance by scanning traffic as it passes through the FortiGate unit. This is achieved by the IPS engine, which processes the data in a single pass. As packets of a file arrive, they are buffered and simultaneously forwarded to the client while being scanned. This concurrent process optimizes throughput and reduces latency compared to proxy-based inspection, which must buffer the entire file before scanning and forwarding it. If a virus is detected mid-stream, the FortiGate immediately stops forwarding the file and resets the connection.

A. Flow-based inspection is a distinct architecture that uses the IPS engine; it is not a hybrid of the scanning modes (full or quick) used by the separate proxy-based engine.
D. If a virus is detected, FortiGate resets the TCP connection. The client receives an incomplete file, not the last packet, to prevent the malware from being delivered.

1. FortiOS 7.0.0 Handbook | Administration Guide

Page 839

Section: "Security Profiles > Antivirus > Inspection modes".

Reference for B & C: "Flow-based inspection can improve performance because the file is being sent to the end user and scanned for viruses at the same time. The FortiGate unit buffers the file as it is downloaded and begins scanning it for viruses. As the file is being downloaded

the FortiGate unit forwards the file to the end user." This supports that performance is optimized (B) and that buffering occurs simultaneously with transmission (C).

Reference for E: "Flow-based inspection uses the IPS engine and does not change packets." This confirms that the IPS engine handles the process.

Reference for D: "If a virus is found

the FortiGate unit caches the virus and discards the file. The end user's web browser displays a message that the connection was reset." This confirms the last packet is not delivered.

Reference for A: The document describes flow-based and proxy-based as two distinct and separate "Inspection modes

" with no mention of flow-based being a hybrid of proxy modes.