View all questions & answers for the NSE 4 - FortiOS 7.6 Administrator Exam Materials exam
Comments
Selected Answers: A, D, E
-
Brave-Dumps.com Admin
2025-07-02 01:01:32
Hi Alex, Correct is ABD, E is totally not correct please check page 233 on study guide -
Jay gabasa
2025-10-28 05:01:29
A is also wrong because its proxy mode which buffers the whole file. Flow, scans it on the fly. -
Jay gabasa
2025-10-28 05:01:34
A is also wrong because its proxy mode which buffers the whole file. Flow, scans it on the fly.
Selected Answers: A, B, D
Selected Answers: A, D, E
Flow-based antivirus scanning
• FortiGate does not fully buffer traffic like proxy mode does.
• Instead, it uses the IPS engine to scan packets as they flow.
• However, when scanning files (like HTTP downloads or SMTP attachments), FortiGate does buffer the file stream in memory while simultaneously transmitting it to the client.
• This means the client starts receiving the file right away, but FortiGate is still scanning the buffered stream in parallel.
Why A is correct
• Statement A: "FortiGate buffers the whole file but transmits to the client at the same time" is describing this parallel buffering + transmission behavior.
-
Dizzle D
2025-12-12 09:03:11
Oops. I meant ABD. not ADE.
Selected Answers: B, D, E
The primary advantage of Flow-based inspection is performance. It scans active traffic packet-by-packet (streaming) without holding up the connection to buffer the entire file. This reduces latency and resource usage compared to Proxy-based inspection, which buffers the full file before delivery.
2. Why E is correct (IPS Engine):
In Flow mode, all security profiles (AV, Web Filter, IPS, Application Control) are processed by the IPS Engine in a single pass. There is no separate "WAD" (Worker) process handling the content like in Proxy mode. The IPS engine handles the antivirus scanning directly as part of its flow processing.
3. Why B is correct (Hybrid Mode):
Modern FortiOS versions (since 6.4/7.0) use a "Hybrid" scanning mode by default for Flow-based AV. This allows the flow engine to employ advanced detection techniques (like emulation) that were traditionally reserved for proxy mode, offering a balance of speed and security accuracy.
Selected Answers: A, B, D
“Flow-based inspection provides better performance compared to proxy-based inspection.”
Selected Answers: A, B, D
Selected Answers: A, B
Regarding D: Because the file is transmitted at the same time, flow-based mode consumes more CPU cycles than proxy-based mode. However, depending on the FortiGate model, some
operations can be offloaded to secure processing units (SPU) to improve performance.
"Flow-based inspection mode packet flow"
Selected Answers: B, D, E
Selected Answers: B, D, E
That is proxy-based behavior
Flow-based = no full buffering
C. Last packet delivered if virus detected → ❌
If virus detected:
Session is terminated
File is blocked, not delivered
Selected Answers: A, B, D
Selected Answers: A, B, D
B-Flow based inspection mode uses a hybrid of two scanning modes (default and legacy scanning mode)
D-
E is wrong because Flow based inspection mode use IPS and AV engines
Selected Answers: B, D, E
Selected Answers: A, D, E
A. In flow-based inspection, FortiGate buffers the file as it passes through but simultaneously begins transmitting packets to the client, rather than holding the entire file until scanning completes (as proxy-based does).
D. Flow-based inspection is designed to optimize performance — it uses a single-pass architecture and less buffering, making it faster and lighter on resources than proxy-based inspection.
E. Flow-based antivirus scanning is handled by the IPS engine as a standalone process, integrated directly into the packet-processing path rather than relying on a separate proxy process.
Selected Answers: A, B, D
Which three statements explain a flow-based antivirus profile? (Choose three answers)
Brave-Dump Clients Votes