Which two statements about antivirus scanning in a firewall policy set to proxy-based inspection mode, are true? (Choose two.)

Which two statements about antivirus scanning in a firewall policy set to proxy-based inspection mode, are true? (Choose two.)
A . A file does not need to be buffered completely before it is moved to the antivirus engine for scanning.
B . The client must wait for the antivirus scan to finish scanning before it receives the file.
C . FortiGate sends a reset packet to the client if antivirus reports the file as infected.
D . If a virus is detected, a block replacement message is displayed immediately.

Answer: B,D

Explanation:

In a firewall policy set to proxy-based inspection mode:

B. The client must wait for the antivirus scan to finish scanning before it receives the file.

In proxy-based inspection, the client may need to wait for the antivirus scan to complete before receiving the file. The file may need to be fully scanned before being delivered to the client, depending on the specific configuration and circumstances.

D. If a virus is detected, a block replacement message is displayed immediately.

If a virus is detected during the antivirus scan in proxy-based inspection mode, FortiGate can generate a block replacement message immediately, informing the user that the file is infected. So, both statements B and D are valid in the context of proxy-based inspection mode.