A network administrator has enabled SSL certificate inspection and antivirus on FortiGate. When downloading an EICAR test file through HTTP…

The antivirus profile is correctly configured, as it successfully detects the EICAR file over unencrypted HTTP. The failure to detect the same file over HTTPS indicates that the traffic is not being decrypted by the FortiGate. A common reason for this is an SSL inspection exemption for the specific website or web category from which the file is being downloaded. When a site is exempted, its traffic passes through the FortiGate without being decrypted, preventing the antivirus engine from inspecting the encrypted file content.

B. The EICAR test file is extremely small (68 bytes) and would not trigger any oversize limit, which is typically configured in megabytes.

C. If the profile was set to 'certificate inspection', AV would fail. However, an exemption is a more specific reason for a single site failing inspection.

D. If the browser did not trust the CA certificate, the user would receive a browser warning, but if they proceeded, the traffic would still be decrypted and inspected.

- FortiOS 7.2 Administration Guide, "Security Profiles > SSL/SSH Inspection" section. It details how exemptions can be configured to bypass SSL inspection for specific sites, which would prevent content inspection like antivirus scanning.

- FortiOS 7.2 Cookbook, "SSL Deep Inspection" chapter, "Exempting traffic from SSL inspection" recipe. This explains that exempted traffic is not decrypted or inspected by security profiles.