Fortinet Fortigate Administrator FCP Fortigate 76 · Free Practice Question Medium
Question 3
Refer to the exhibits.
The exhibits show a firewall policy (Exhibit A) and an antivirus profile (Exhibit B).
Why is the user unable to receive a block replacement message when downloading an infected file for the first time?
-
A
A. The volume of traffic being inspected is too high for this model of FortiGate.
-
B
B. The intrusion prevention security profile needs to be enabled when using flow-based inspection mode.
-
C
C. The firewall policy performs the full content inspection on the file.
-
D
D. The flow-based inspection is used, which resets the last packet to the user.
Reveal correct answer
Correct answer: D
Explanation
Correct answer: D. The flow-based inspection is used, which resets the last packet to the user.
Key to right answer is "unable to receive a block replacement message when downloading an infected file for the first time".
• "ONLY" If the virus is detected at the "START" of the connection, the IPS engine sends the block replacement message immediately
• When a virus is detected on a TCP session (FIRST TIME), but where "SOME PACKETS" have been already forwarded to the receiver, FortiGate "resets the connection" and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that if a "SECOND ATTEMPT" to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
Two possible scenarios can occur when a virus is detected:
- When a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FG resets the connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can't be opened. The IPS engine also caches the URL of the infected file, so that IF A SECOND ATTEMPT TO TRANSMIT THE FILE IS MADE, THE IPS ENGINE WILL SEND A BLOCK REPLACEMENT MESSAGE to the client instead of scanning the file again.
- If the virus is detected at the start of the connection, the IPS engine sends the block replacement message immediately.
In flow based inspection, when a virus is detected on a TCP session where some packets have been already forwarded to the receiver, FortiGate resets the connection and does not send the last piece of the file. Although the receiver got most of the file content, the file has been truncated and therefore, can’t be opened. The IPS engine also caches the URL of the infected file, so that if a second attempt to transmit the file is made, the IPS engine will then send a block replacement message to the client instead of scanning the file again.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
