Smart Scan offloads much of the malware scanning workload to a dedicated external Smart Protection Server (can be Trend Micro-hosted or on-premise), rather than performing all scanning and pattern lookups locally. The endpoint performs a lightweight initial scan and then queries the Smart Protection Server for advanced analysis, improving performance and reducing pattern update frequency on endpoints.
From the official documentation:
"With Smart Scan, the agent sends file or process attributes to a Smart Protection Server, which then performs the pattern matching and returns the result. This allows agents to use a smaller local pattern file and offloads the majority of scanning to the Smart Protection infrastructure."
Option B is correct.
Option A is misleading; although file features are checked externally, the main difference is offloading, not capture rate.
Option C is incorrect; both methods can scan in real-time.
Option D describes IntelliScan, not Smart Scan.
[References:, , Trend Micro Deep Security Help: Smart Scan, , Trend Micro Smart Protection Server Administrator’s Guide]
Submit