A utility security analyst is comparing how antivirus scanning behaves in a flow-based firewall policy versus a proxy-based one for the field-technician VPN segment. Which statement correctly describes flow-based antivirus scanning?
Select an answer to reveal the explanation.
Short Explanation
Flow-based antivirus works like a lifeguard watching a river instead of draining the pool to check it: it examines the data as it streams past rather than holding the whole file first. That inline approach keeps things fast and is the natural fit for a VPN segment carrying a mix of everyday traffic. It's still real scanning, just architected differently from the buffer-then-release approach proxy-based mode uses.
Full Explanation
Flow-based antivirus is implemented through the same single-pass IPS engine that handles the rest of flow-based content inspection: it inspects the traffic as it moves through the FortiGate, comparing it against signatures on the fly, rather than holding the entire object in a buffer before deciding whether to forward it. This keeps overhead low, which suits a field-technician VPN segment carrying a variety of session types and sizes. It is not true that flow-based mode lacks antivirus capability altogether — antivirus profiles apply to flow-based policies just as they do to proxy-based ones, only the underlying scanning architecture differs. There is also no dependency on an external FortiAnalyzer for the scanning itself; FortiAnalyzer is a logging and analytics platform that can receive antivirus event logs, but detection happens on the FortiGate. And antivirus scanning is independent of whether SSL deep inspection is enabled — deep inspection determines whether encrypted payloads are visible to the antivirus engine at all, but it does not gate whether flow-based scanning functions on the traffic it can see. To validate, review the antivirus profile applied to the VPN policy and confirm log entries are generated for detected signatures, regardless of the SSL inspection setting.