NSE4 Security Profiles Practice Question
Which inspection mode in the antivirus profile processes traffic by buffering the entire file before scanning, allowing more thorough detection but potentially increasing latency?
⚠ Common exam trap
A common mix-up: candidates confuse 'deep inspection' with 'proxy-based inspection' because both involve thorough analysis, but deep inspection specifically refers to SSL/TLS decryption, not the file buffering mechanism in antivirus profiles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Proxy-based inspection
Proxy-based inspection in the antivirus profile buffers the entire file in memory before scanning, enabling thorough detection of threats like polymorphic malware or embedded exploits. This mode reassembles the full data stream, allowing the FortiGate to perform deep content analysis, but it introduces higher latency due to the buffering and reassembly process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Proxy-based inspection
Why this is correct
Proxy-based inspection is the correct mode because it buffers the entire file in memory before scanning, allowing FortiOS to perform a thorough, full-file signature analysis. This enables detection of threats embedded deep within archives, compressed files, or multi-part executables that could evade streaming methods. As a result, it provides the highest fidelity for antivirus detection, albeit with added latency proportional to file size.
- ✗
Deep inspection
Why it's wrong here
Deep inspection is a misnomer here: in FortiOS, "deep inspection" refers to SSL/TLS decryption and certificate inspection via proxy or flow, not to a file-scanning mode within an antivirus profile. It allows security engines to examine encrypted traffic, but it does not dictate how the antivirus scanner buffers or processes a file after decryption. Therefore it is not one of the two antivirus inspection modes (proxy-based and flow-based).
- ✗
DNS inspection
Why it's wrong here
DNS inspection is unrelated to antivirus scanning modes; it is a component of the DNS filter feature that inspects DNS queries and blocks resolution of known malicious domains. Antivirus profiles focus on file-based threats in HTTP, FTP, IMAP, SMTP, and other protocols, using signatures to match file content. Choosing DNS inspection confuses protocol-level filtering with application-layer file scanning.
- ✗
Flow-based inspection
Why it's wrong here
Flow-based inspection is the opposite approach: it scans traffic as a streaming session without buffering the entire file, minimizing latency and memory consumption. Because it only sees packets in transit, it cannot perform deep analysis of file structure, full decompression, or detect threats that depend on the complete file content. While efficient, it is not the mode described in the question, which specifically requires buffering the entire file before scanning.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.