How does Smart Scan vary from conventional pattern-based anti-malware scanning?

Smart Scan offloads much of the malware scanning workload to a dedicated external Smart Protection Server (can be Trend Micro-hosted or on-premise), rather than performing all scanning and pattern lookups locally. The endpoint performs a lightweight initial scan and then queries the Smart Protection Server for advanced analysis, improving performance and reducing pattern update frequency on endpoints.

From the official documentation:

"With Smart Scan, the agent sends file or process attributes to a Smart Protection Server, which then performs the pattern matching and returns the result. This allows agents to use a smaller local pattern file and offloads the majority of scanning to the Smart Protection infrastructure."

Option B is correct.

Option A is misleading; although file features are checked externally, the main difference is offloading, not capture rate.

Option C is incorrect; both methods can scan in real-time.

Option D describes IntelliScan, not Smart Scan.