The Intrusion Prevention System (IPS) engine in FortiOS is a core component responsible for advanced protocol decoding and signature-based inspection. Application Control, DNS Filter, and Web Application Firewall (WAF) all fundamentally rely on this engine to function. Application Control uses it to identify application traffic, DNS Filter uses it to inspect DNS requests against categories, and WAF uses it to detect web-specific attacks.

A. While flow-based web filtering uses the IPS engine for protocol decoding, its primary function is URL/category lookup, which is a separate subsystem.

B. Flow-based antivirus uses the IPS engine to extract files from traffic streams, but the actual malware scanning is performed by a distinct antivirus engine.

1. FortiGate Security 7.2 Study Guide, page 10. A diagram explicitly shows the IPS engine as the core component for IPS, Application Control, and Web Application Firewall (WAF) features.

2. FortiGate Security 7.2 Study Guide, page 171. It states, "DNS filter uses the IPS engine to inspect DNS traffic."

3. FortiOS Handbook 7.2 - Security Profiles, "Application Control" chapter. It details that application signatures are part of the IPS package and processed by the IPS engine.

4. FortiOS Handbook 7.2 - Security Profiles, "Web Application Firewall" chapter. It explains that WAF uses the IPS engine with a specialized signature set to protect against web application threats.