A regional utility's NOC administrator wants FortiGate to buffer entire downloaded files from the corporate billing segment so antivirus can inspect the complete payload and present a custom block page when malware is found, rather than simply resetting the session mid-transfer. Which inspection mode should the policy use to get that behavior?
Select an answer to reveal the explanation.
Short Explanation
Think of proxy-based inspection like a mail room that holds a package until it's fully X-rayed before handing it over. That buffering is exactly what lets FortiGate scan a whole file and swap in a friendly block page instead of just yanking the connection. Flow-based inspection, by contrast, streams the data through as it arrives, which is fast but leaves less room for that kind of full-object handling.
Full Explanation
Proxy-based inspection reconstructs the full object — the complete HTTP response, the whole downloaded file — inside a proxy before forwarding it to the client, which is what lets FortiGate run a complete antivirus scan and substitute a custom replacement page when a threat is found, since the original content never needs to reach the endpoint. Flow-based inspection is a single-pass, streaming architecture built on the IPS engine: it examines the traffic as it flows, which keeps latency low and is the default for most policies, but it does not buffer the whole object the same way, so some of the richer proxy-only handling (like full replacement-message behavior on certain protocols) is not available there. Certificate inspection is not a competing mode at all — it is a shallower level of SSL visibility that only reads the handshake and never touches file content, so it cannot drive antivirus decisions on payload. Full SSL inspection is a real setting, but it answers a different question: it controls whether an encrypted session gets decrypted at all, not whether the resulting content is streamed through flow-based or buffered whole by a proxy — decrypting a session with flow-based inspection still doesn't give FortiGate a full object to hold and replace, so SSL inspection level and inspection mode are independent knobs, and the buffering behavior in question comes from the inspection mode, not the SSL setting. Before committing a policy to proxy-based mode, check the antivirus profile's oversize-file handling, since buffering a very large file still has a configurable size limit.