Which three steps are executed to get antivirus and IPS updates using the pull method?

To understand why the correct response involves obtaining a list of server IP addresses that can be contacted, it's important to consider the process of how a FortiGate device retrieves updates for antivirus and Intrusion Prevention System (IPS) effectively.

In the pull method for updates, the FortiGate device typically needs to establish a connection to FortiGuard servers, which provide the necessary updates. To do so, the device must first identify the addresses of the servers it can contact, which involves querying a DNS server. This step is critical because without knowing the IP addresses of the FortiGuard servers, the FortiGate device would not be able to connect to the right resources to check for updates.

Once it has the server addresses, the FortiGate can then proceed to connect to one of these servers to download the actual updates. This highlights the importance of being able to resolve the FortiGuard domain and access the correct server addresses as foundational steps that precede the actual download of updates.

Other steps mentioned can be seen as part of the broader update process. The device downloads updates directly from FortiGate's servers once the prior steps (i.e., resolving domain names and getting server IPs) are completed. Furthermore, periodic queries for pending updates represent