The firewall policy is configured to use the certificate-inspection SSL inspection profile. This mode only examines the server's certificate during the SSL/TLS handshake to verify its validity and identify the server name. It does not decrypt the encrypted traffic payload. Because the EICAR virus signature is contained within the encrypted HTTPS data stream, the antivirus engine cannot inspect the content. To detect the virus, the policy would need to be configured with a deep inspection profile, which decrypts the traffic, allows the antivirus engine to scan it, and then re-encrypts it before sending it to the client.

A. The exhibit clearly shows that the Web Filter profile named default is enabled on the firewall policy, so this statement is factually incorrect.

C. Flow-based inspection mode can perform antivirus scanning. The inability to scan is due to encryption, not the inspection mode itself. Deep inspection is required in either mode.

D. The action is correctly set to ACCEPT. Security profiles like antivirus are applied to accepted traffic; a DENY action would block all traffic, preventing any inspection.

FortiOS 7.2 Security Profiles Guide, Page 18, Section: "SSL/TLS Inspection". It states, "Without SSL inspection, security features that require content inspection, such as Antivirus, Web Filter, DLP, and Application Control, cannot inspect encrypted traffic."

FortiOS 7.2 Administration Guide, Page 488, Section: "SSL & TLS inspection". The guide clarifies, "Certificate inspection: Only inspects the certificate. The traffic is not decrypted." This confirms why the AV engine is blind to the traffic's content.