Antivirus

Question 1

What is the order of scanning operations for antivirus?

Answer 1

Antivirus scan (exact match)
Grayware (unwanted program)
AI Scan (new, unknown)

Question 2

What are the two Antivirus Signature Databases?

Answer 2

Extended: default (signatures for viruses in the most recent months)

Extreme: (all known viruses and old OS support) (does not work on all models)

Question 3

What does CDR stand for?

Answer 3

Content disarm and reconstruction

Question 4

For AV, what is the difference between default scan mode and the legacy scanning mode?

Answer 4

Default enhances the scanning of nested archive files without buffering the container file. Where as legacy mode buffers the whole container file, and then scans it.

Question 5

How do packets flow in flow-based inspection mode?

Answer 5

Packets are buffered and sent to the host, except the last packet. FTG sends all the packets to the IPS engine reassembles the file, sends it to the AV engine, if no virus, then send last packet to host. If there is a virus the last packet is not sent and the connection truncated.

Question 6

Do clients have to wait for the AV scan to finish in proxy inspection mode?

Answer 6

Yes, however you can turn on client comfort to pass a block or two so the connection is kept open

Question 7

How does buffering work in Proxy Mode Inspection for AV?

Answer 7

The entire file is buffered

Question 8

What is stream-based AV scanning?

Answer 8

decompresses large files and then scans and extracts them at the same time. Viruses are detected even if they are in the middle or towards the end of a large archive.

Question 9

What must be configured to enable proxy based AV inspection?

Answer 9

You must select proxy based in both the AV profile and FW policy.

Question 10

What additional AV scanning options are available if using proxy AV scanning mode?

Answer 10

MAPI and SSH inspection
Sanitize MS office and PDFs with CDR

Question 11

By default, what does FortiOS do with oversized files?

Answer 11

it does not scan them

Question 12

Can FTG decompress archive files with a password?

Answer 12

no

Question 13

How many layers of compression will FTG scan for viruses? By default?

Answer 13

12

Question 14

Does Fortinet recommend deep-inspection for SSL/SSH for AV Scanning?

Answer 14

Yes

Question 15

What FTG can offload Flow-based AV scanning

Answer 15

Models that feature Turbo (NP6 or NP7)

Question 16

What can CP8 or CP9 (content processes offload)

Answer 16

offload flow-based pattern matching and SSL inspection

Question 17

What command can you use to check if the AV DB is updated?

Answer 17

execute update-av