An administrator installs FortiClient on Windows Server. What is the default behavior of real-time protection control?

An administrator installs FortiClient on Windows Server.
What is the default behavior of real-time protection control?

A. Real-time protection must update AV signature database. B. Real-time protection is disabled. C. Real-time protection sends malicious files to FortiSandbox when the file is not detected locally. D. Real-time protection must update the signature database from FortiSandbox.