Which two statements about antivirus scanning in a firewall policy set to proxy-based inspection mode, are true? (Choose two.)

In proxy-based inspection mode, the FortiGate firewall acts as a true proxy, buffering the entire file before performing a security scan. This means the client must wait for the download and the antivirus scan to complete before receiving the file, making the process more thorough but introducing latency. If the antivirus engine detects a threat, the FortiGate blocks the file, sends a block replacement message to the user, and then terminates the TCP session with the client, typically by sending a TCP reset (RST) packet to close the connection abruptly.

A. This statement describes flow-based inspection, where files are scanned in chunks as they arrive. Proxy-based inspection requires the entire file to be buffered first.

D. The term "immediately" is misleading. The block message is displayed only after the entire file has been downloaded and scanned, a process that is not immediate from the user's perspective.

1. Fortinet FortiOS 7.0.1 Handbook - Inspection Modes: "In proxy-based inspection

the FortiGate buffers the traffic and inspects it as a whole before sending it to its destination... This provides a higher level of threat protection... If a threat is found

the FortiGate can send a reset packet to the client device to close the connection." (FortiOS Handbook

Version 7.0.1

Firewall > Inspection modes

p. 105).

2. Fortinet FortiOS 7.0.1 Handbook - AntiVirus: "In proxy-based inspection mode

the FortiGate buffers the file and scans it. If no virus is found

it is sent to the client. If a virus is found

the FortiGate caches the virus and the content is not sent to the user. The user sees a replacement message..." (FortiOS Handbook

Version 7.0.1

Security Profiles > AntiVirus

p. 518). This confirms the client waits for the scan to finish before receiving the file.