Which three statements explain a flow-based antivirus profile? (Choose three.)

Flow-based antivirus inspection is designed for performance. It scans files as they transit the FortiGate, forwarding packets to the client simultaneously. This method significantly enhances throughput compared to proxy-based inspection, which must buffer the entire file before scanning and forwarding. The official documentation describes this process as buffering the file while sending it at the same time. Furthermore, flow-based inspection employs a hybrid scanning approach, combining techniques from the modes available in proxy-based inspection to balance security and performance. If a virus is detected, the final packets are dropped, preventing the complete file from reaching the client.

C. If a virus is detected, the FortiGate drops the last packet(s) containing the malicious signature and sends a reset packet, ensuring the client receives an incomplete and unusable file.
E. Flow-based antivirus scanning is handled by the integrated IPS engine as part of FortiOS's single-pass architecture; it is not a standalone process.

1. Fortinet FortiOS 7.6.1 Administration Guide

Security Profiles > Antivirus > AV scanning modes

p. 1031:

"Flow-based inspection enhances throughput compared to proxy-based inspection." (Supports option D)

"The FortiGate buffers the file and sends it to the client at the same time." (Supports option A)

"Flow-based inspection uses a hybrid of the scanning modes available in proxy-based inspection." (Supports option B)

"If a virus is found

the FortiGate unit caches the virus and drops the packets... The FortiGate unit also sends a reset packet to the client." (Refutes option C)

2. Fortinet FortiOS Handbook 7.6 - Security Profiles

Antivirus > Inspection Modes:

"In flow-based mode

antivirus scanning is done by the IPS engine." (Explains the mechanism

refuting the "standalone" nature in option E

as the IPS engine is an integrated component).