Refer to the exhibits. The exhibits show a firewall policy (Exhibit A) and an antivirus profile (Exhibit B). Why is the user unable to receive a block replacement message when downloading an infected file for the first time?
A.
The firewall policy performs a full content inspection on the file.
B.
The intrusion prevention security profile must be enabled when using flow-based inspection mode.
C.
Flow-based inspection is used, which resets the last packet to the user.
D.
The volume of traffic being inspected is too high for this model of FortiGate.
In flow based inspection, when a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FortiGate resets the connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that if a second attempt to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
C. Flow-based inspection is used, which resets the last packet to the user.
Reference and download study guide:
https://ebin.pub/fortinet-fortigate-security-study-guide-for-fortios-72.html
Security 7_2 pag. 363.
For flow-based inspection mode scanning, if a virus is detected at the start of the stream, the block replacement page is displayed at the first attempt. If a virus is detected after a few packets have been transmitted, the block replacement page is not displayed. However, FortiGate caches the URL and can display the replacement page immediately, on the second attempt.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
BoostBoris
Highly Voted 2 years, 2 months agoerawemk
Highly Voted 1 year, 10 months agoCisco_SE_765
Most Recent 11 months, 1 week agoSlash_JM
1 year, 7 months agoraydel92
1 year, 8 months agodarkstar15
1 year, 9 months ago