NSE4 Security Profiles Practice Question
A FortiGate in flow-based mode is configured with an antivirus profile to block infected files. A user downloads a .zip file containing a known virus, but the download is allowed and the file is not quarantined. What is the MOST likely reason?
⚠ Common exam trap
Watch out — candidates often assume flow-based and proxy-based modes behave identically regarding archive scanning, but FortiGate's flow-based mode requires explicit configuration to decompress archives, whereas proxy-based mode does it by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Flow-based inspection does not decompress archives by default
In flow-based inspection mode, FortiGate does not decompress archive files (such as .zip) by default. This means the antivirus engine cannot inspect the contents of the compressed file, so even if a known virus is inside, it will not be detected or blocked. To inspect archives in flow-based mode, you must enable 'deep archive inspection' in the antivirus profile.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The antivirus profile is not set to 'block' for virus outbreaks
Why it's wrong here
In FortiOS antivirus profiles, the action for a detected virus outbreak is a separate setting from the archive inspection capability. If the profile were set to "monitor" or "disable", the FortiGate would log but not block infected files, which could explain a missed detection. However, in flow-based inspection mode, the root cause is that the streaming scanner never decompresses the .zip file to see the virus inside, regardless of the action setting. Even if you changed the outbreak action to "block", the virus inside the archive would still not be examined, so this is not the correct fix.
- ✗
The virus definition database is outdated
Why it's wrong here
An outdated virus database is a general cause of missed detections across all file types, because the engine simply lacks the specific signature. This scenario involves a known virus inside a .zip archive, which is a specific inspection-mode limitation rather than a signature coverage gap. In flow mode, the antivirus engine streams the archive file itself and does not extract its contents for scanning, so even with a current database the virus would not be found. Updating signatures would not enable decompression, so this is not the underlying issue.
- ✗
Flow-based inspection does not support antivirus for .zip archives
Why it's wrong here
Flow-based inspection does not reject .zip archives entirely; the FortiGate still scans the archive file itself and can match signatures against the compressed container. However, because flow inspection is a streaming, single-pass mechanism, it does not buffer and decompress the archive to expose the individual files inside. Therefore, saying flow mode "does not support antivirus for .zip archives" is an overstatement: it scans the archive as a file, but cannot inspect the contents. The real limitation is the lack of archive decompression, not a lack of antivirus support.
- ✓
Flow-based inspection does not decompress archives by default
Why this is correct
In flow-based inspection mode, the FortiGate processes files in a streaming fashion, reading data as it flows through and not buffering the whole file, which means it cannot decompress archive files like .zip before scanning their contents. Because the virus is hidden inside the .zip, the scanner never actually sees it, so the file passes through undetected even if signatures are current. Proxy-based inspection, in contrast, buffers the entire file and can decompress archives to scan each contained file, which is why flow mode fails in this situation. The default behavior in flow mode is not to decompress archives, making this the correct explanation.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.