An administrator is choosing between flow-based and proxy-based inspection for a firewall policy that will carry an antivirus profile scanning HTTP, SMTP and FTP traffic. They need to weigh malware detection coverage against the per-session overhead each mode imposes. Which two statements correctly describe how proxy-based antivirus differs from flow-based antivirus on a FortiGate? Select TWO.
- AProxy-based inspection buffers the complete file before scanning, so it can fully reconstruct archives and apply the broadest set of detection options before the file is released to the client. Correct
- BProxy-based inspection generally consumes more session memory and adds more latency than flow-based, which streams the traffic and scans it as it passes without full buffering. Correct
- CFlow-based inspection buffers each file in full before forwarding it, so it always matches the detection coverage of proxy-based inspection while using less memory.
- DProxy-based inspection can only scan HTTP traffic, whereas flow-based inspection is the only mode that supports SMTP and FTP antivirus scanning.
- EFlow-based inspection requires a separate explicit proxy to be configured on the policy before the antivirus profile will scan any traffic at all.
Why A is correct: Correct: proxy mode acts as a transparent intermediary that holds the whole object, allowing full reassembly of nested archives and the widest detection feature set before delivery.
Why B is correct: Correct: buffering the entire file costs memory and delay, so proxy mode trades higher per-session overhead for deeper coverage, while flow mode is lighter because it inspects the stream in passing.
Why C is wrong: This is tempting because both modes scan for malware, but flow mode does not fully buffer files; it streams them, so it cannot match proxy mode's full-reconstruction coverage.
Why D is wrong: This misstates protocol support; proxy mode handles HTTP, SMTP, FTP and other protocols, so the claim that it is HTTP-only is wrong.
Why E is wrong: This confuses flow mode with explicit-proxy deployment; flow-based antivirus scans inline on a normal policy and needs no explicit proxy to function.