A utility security engineer configures antivirus on a proxy-based policy so that when a file download is confirmed infected, FortiGate withholds the file from the requester and presents a substitute notification page rather than merely dropping the connection. Which behavior does this depend on that flow-based inspection does not provide in the same way?

Because proxy-based inspection reconstructs the complete file inside the internal proxy before releasing anything to the requester, FortiGate can finish its antivirus verdict first and then choose exactly how to respond — including substituting a clean notification page in place of the infected file — rather than having to react mid-stream. Flow-based inspection evaluates data through the IPS engine as it passes through, which is efficient but does not offer that same buffer-then-decide sequencing, so the specific full-object substitute-page behavior described here is tied to the proxy-based architecture rather than to antivirus signatures being unavailable in flow-based mode; flow-based antivirus still detects and blocks the same threats, just via a different response mechanism. Automatic backup-WAN-link routing is an SD-WAN function entirely separate from how a detected threat is handled at the content layer. RADIUS authentication of the requesting user is a firewall-authentication concern that determines who is allowed to open a session in the first place, not how a detected-malware response is presented once scanning is underway. To confirm this behavior in practice, test a known-safe EICAR test file download through the proxy-based policy and observe whether a replacement notification page appears rather than a simple connection reset.