Exam NSE4_FGT-7.0 topic 1 question 3 discussion

Actual exam question from Fortinet's NSE4_FGT-7.0

Question #: 3
Topic #: 1

Refer to the exhibits to view the firewall policy (Exhibit A) and the antivirus profile (Exhibit B).
Exhibit A.

Exhibit B.

Which statement is correct if a user is unable to receive a block replacement message when downloading an infected file for the first time?

A. The flow-based inspection is used, which resets the last packet to the user.
B. The volume of traffic being inspected is too high for this model of FortiGate.
C. The firewall policy performs the full content inspection on the file.
D. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.

Show Suggested Answer

Suggested Answer: A 🗳️

by jlfoul at Sept. 9, 2022, 9:15 a.m.

Comments

Submit Cancel

bccabrera

Highly Voted 1 year, 7 months ago

Selected Answer: A

Study Guide - Antivirus - Antivirus Scanning Modes - Flow-Based Inspection Mode. Two possible scenarios can occur when a virus is detected: - When a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FG resets the connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that IF A SECOND ATTEMPT TO TRANSMIT THE FILE IS MADE, THE IPS ENGINE WILL SEND A BLOCK REPLACEMENT MESSAGE to the client instead of scanning the file again. - If the virus is detected at the start of the connection, the IPS engine sends the block replacement message immediately.

upvoted 15 times