The provided configuration set av-failopen pass explicitly instructs the FortiGate to allow traffic to pass without inspection if the antivirus scanning daemon (scand) fails. The debug output for scand confirms two key points: the scand daemon state is stopped, and the av-failopen mode is pass. Therefore, any new session that matches a firewall policy requiring antivirus inspection will be allowed to proceed without being scanned. While the IPS engine is also down and would block traffic, option A accurately describes the direct consequence of the specific, non-default configuration provided in the exhibit.

B. It is allowed and inspected as long as the inspection is flow based: This is incorrect because the relevant inspection daemons (scand, ipsmonitor) are stopped, meaning no inspection of any kind can occur.

C. It is dropped: This is not universally true. While traffic requiring IPS inspection would be dropped, traffic requiring only antivirus inspection is explicitly allowed due to the av-failopen pass setting.

D. It is allowed and inspected, as long as the only inspection required is antivirus: This is incorrect because the traffic is allowed but it is not inspected. The purpose of the fail-open mechanism is to bypass inspection when the service is unavailable.

1. FortiOS Administration Guide 7.4.1

Page 1018

"Fail-open behavior": "By default

when a daemon fails

traffic that is supposed to be processed by that daemon is blocked. This is fail-close behavior. You can configure fail-open behavior to allow traffic to pass through without being processed when the daemon fails." This document confirms the principle of fail-open.

2. FortiOS CLI Reference 7.4.1

Page 103

config system global: The set av-failopen pass command is documented here. It enables traffic to pass when the AV service is unavailable

which is the scenario shown in the debug output.

3. FortiOS Handbook - Security Profiles for FortiOS 7.4.0

Page 21

"Fail-open configuration": "You can configure fail-open to allow traffic to pass through the FortiGate unit without being scanned if the IPS or antivirus scanner fails." This directly supports that av-failopen pass allows traffic when the antivirus scanner has failed.