Antivirus and Content Security
This domain tests file scanning, URL filtering, file filtering, and mail filtering on security gateways. Questions focus on where scanning happens and what it cannot see.
Core rules
- Antivirus scans files over HTTP, FTP, SMTP, POP3, and IMAP; it checks file type, size limits, and engine signatures.
- Content security profiles combine antivirus, IPS, URL filtering, file filtering, and mail filtering, and are referenced by a permitting security policy.
- URL filtering categorizes sites and can allow, block, or warn; file filtering blocks by extension or MIME type.
- Scanning occurs after policy permit; denied traffic is not scanned.
- Encrypted traffic is not inspected unless the gateway decrypts it.
Worked example
Block .exe downloads from the Internet for all users. Create a file filtering profile that denies exe, attach it to the Trust-to-Untrust permit rule, and keep the antivirus profile for other malware. Reasoning: file filtering matches the extension, while antivirus matches signatures. Both can coexist, and the security policy is the enforcement point. If HTTPS is used, decryption is required for either profile to see the file.
Traps that cost marks
- Assuming antivirus blocks all malware without matching signatures.
- Forgetting file size limits that let large files bypass scanning.
- Expecting HTTPS scanning without decryption.
- Applying a profile to the wrong zone direction.