View all questions & answers for the NSE 4 - FortiOS 7.6 Administrator Exam Materials exam
NSE 4 - FortiOS 7.6 Administrator Exam Materials - Question #13 Discussion
Community Explanations & Comments (14)
Alex
1 year ago
Selected: A, D, E
I think this is ADE, flow-based anti-virus is handles by the IPS engine. It's worth checking this one.
Brave-Dumps.com Admin
1 year ago
Hi Alex, Correct is ABD, E is totally not correct please check page 233 on study guide
Jay gabasa
1 year ago
A is also wrong because its proxy mode which buffers the whole file. Flow, scans it on the fly.
Jay gabasa
1 year ago
A is also wrong because its proxy mode which buffers the whole file. Flow, scans it on the fly.
Flo Dew
10 months ago
Selected: A, B, D
Agree A B D
Dizzle D
10 months ago
Selected: A, D, E
The key lies in the difference between flow-based inspection in general and how flow-based antivirus scanning actually works:
Flow-based antivirus scanning
• FortiGate does not fully buffer traffic like proxy mode does.
• Instead, it uses the IPS engine to scan packets as they flow.
• However, when scanning files (like HTTP downloads or SMTP attachments), FortiGate does buffer the file stream in memory while simultaneously transmitting it to the client.
• This means the client starts receiving the file right away, but FortiGate is still scanning the buffered stream in parallel.
Why A is correct
• Statement A: "FortiGate buffers the whole file but transmits to the client at the same time" is describing this parallel buffering + transmission behavior.
Flow-based antivirus scanning
• FortiGate does not fully buffer traffic like proxy mode does.
• Instead, it uses the IPS engine to scan packets as they flow.
• However, when scanning files (like HTTP downloads or SMTP attachments), FortiGate does buffer the file stream in memory while simultaneously transmitting it to the client.
• This means the client starts receiving the file right away, but FortiGate is still scanning the buffered stream in parallel.
Why A is correct
• Statement A: "FortiGate buffers the whole file but transmits to the client at the same time" is describing this parallel buffering + transmission behavior.
Dizzle D
10 months ago
Oops. I meant ABD. not ADE.
Ijaz
10 months ago
Selected: B, D, E
1. Why D is correct (Performance):
The primary advantage of Flow-based inspection is performance. It scans active traffic packet-by-packet (streaming) without holding up the connection to buffer the entire file. This reduces latency and resource usage compared to Proxy-based inspection, which buffers the full file before delivery.
2. Why E is correct (IPS Engine):
In Flow mode, all security profiles (AV, Web Filter, IPS, Application Control) are processed by the IPS Engine in a single pass. There is no separate "WAD" (Worker) process handling the content like in Proxy mode. The IPS engine handles the antivirus scanning directly as part of its flow processing.
3. Why B is correct (Hybrid Mode):
Modern FortiOS versions (since 6.4/7.0) use a "Hybrid" scanning mode by default for Flow-based AV. This allows the flow engine to employ advanced detection techniques (like emulation) that were traditionally reserved for proxy mode, offering a balance of speed and security accuracy.
The primary advantage of Flow-based inspection is performance. It scans active traffic packet-by-packet (streaming) without holding up the connection to buffer the entire file. This reduces latency and resource usage compared to Proxy-based inspection, which buffers the full file before delivery.
2. Why E is correct (IPS Engine):
In Flow mode, all security profiles (AV, Web Filter, IPS, Application Control) are processed by the IPS Engine in a single pass. There is no separate "WAD" (Worker) process handling the content like in Proxy mode. The IPS engine handles the antivirus scanning directly as part of its flow processing.
3. Why B is correct (Hybrid Mode):
Modern FortiOS versions (since 6.4/7.0) use a "Hybrid" scanning mode by default for Flow-based AV. This allows the flow engine to employ advanced detection techniques (like emulation) that were traditionally reserved for proxy mode, offering a balance of speed and security accuracy.
Anonymous User
10 months ago
Selected: A, B, D
“Flow-based inspection scans content as it passes through the FortiGate.”
“Flow-based inspection provides better performance compared to proxy-based inspection.”
“Flow-based inspection provides better performance compared to proxy-based inspection.”
ali pc
9 months ago
Selected: A, B, D
.
Kacper
8 months ago
Selected: A, B
A and B - agree
Regarding D: Because the file is transmitted at the same time, flow-based mode consumes more CPU cycles than proxy-based mode. However, depending on the FortiGate model, some
operations can be offloaded to secure processing units (SPU) to improve performance.
"Flow-based inspection mode packet flow"
Regarding D: Because the file is transmitted at the same time, flow-based mode consumes more CPU cycles than proxy-based mode. However, depending on the FortiGate model, some
operations can be offloaded to secure processing units (SPU) to improve performance.
"Flow-based inspection mode packet flow"
Anonymous User
8 months ago
Selected: B, D, E
B,D,E is correct
Naiyar Rizvi
6 months ago
Selected: B, D, E
A. Buffers whole file → ❌
That is proxy-based behavior
Flow-based = no full buffering
C. Last packet delivered if virus detected → ❌
If virus detected:
Session is terminated
File is blocked, not delivered
That is proxy-based behavior
Flow-based = no full buffering
C. Last packet delivered if virus detected → ❌
If virus detected:
Session is terminated
File is blocked, not delivered
Anonymous User
6 months ago
Selected: A, B, D
agree
ali
5 months ago
Selected: A, B, D
A-FG buffers but also transmits simultanesouly
B-Flow based inspection mode uses a hybrid of two scanning modes (default and legacy scanning mode)
D-
E is wrong because Flow based inspection mode use IPS and AV engines
B-Flow based inspection mode uses a hybrid of two scanning modes (default and legacy scanning mode)
D-
E is wrong because Flow based inspection mode use IPS and AV engines
Anonymous User
5 months ago
Selected: B, D, E
BDE is correct one As IPS + AV + App Control in a single pass
Anonymous User
3 months ago
Selected: A, D, E
Correct answers: A, D, E
A. In flow-based inspection, FortiGate buffers the file as it passes through but simultaneously begins transmitting packets to the client, rather than holding the entire file until scanning completes (as proxy-based does).
D. Flow-based inspection is designed to optimize performance — it uses a single-pass architecture and less buffering, making it faster and lighter on resources than proxy-based inspection.
E. Flow-based antivirus scanning is handled by the IPS engine as a standalone process, integrated directly into the packet-processing path rather than relying on a separate proxy process.
A. In flow-based inspection, FortiGate buffers the file as it passes through but simultaneously begins transmitting packets to the client, rather than holding the entire file until scanning completes (as proxy-based does).
D. Flow-based inspection is designed to optimize performance — it uses a single-pass architecture and less buffering, making it faster and lighter on resources than proxy-based inspection.
E. Flow-based antivirus scanning is handled by the IPS engine as a standalone process, integrated directly into the packet-processing path rather than relying on a separate proxy process.
Anonymous User
4 weeks ago
Selected: A, B, D
A B D
Which three statements explain a flow-based antivirus profile? (Choose three answers)
Brave-Dump Community Votes