FSSO I

FSSO software identifies: (Select 3)

Microsoft AD types mode:

Polling mode:

In FSSO, FortiGate allows network access based on

Which working mode is used for monitoring user sign-on activities in Windows AD? 0

DC Agent is responsible for:

Collector agent is responsible for:

DC agent mode requires: Two DC agent installed on each Windows DC If you have multiple DCs, this means that you need multiple DC agents. DC agents monitor and forward user logon events to the collector agents.

Collector Agent sends: (Select 4)

Ports used for DC Agent

Collector agents uses:

Three methods of the collector agent for collecting logon information:

Polls temporary sessions created on the DC when a user logs in or logs off and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some logon events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify Forthate.

Polls all the security event logs from the DC. It doesn't miss any logon events that have been recorded by the DC because events are not normally deleted from the logs. There can be some delay in FortiGate receiving events if the network is large and, therefore, writing to the logs is slow. It also requires that the audit success of specific event IDS is recorded in the Windows security logs. For a full list of supported event IDs, visit the Fortinet knowledge base site (http://kb.fortinet.com).

A Windows API that gets system information from a Windows server. The DC returns all requested logon events. The collector agent is a WMI client and sends WMI queries for user logon events to the DC, which, in this case, is a WMI server. The collector agent doesn't need to search security event logs on the DC for user logon events; instead, the DC returns all requested logon events. This reduces network load between the collector agent and DC.

Installation: Complex—multiple installations (one per DC). Requires reboot. DC agent required: Yes Resources: Shares with DC agents Scalability: Higher Redundancy: Yes Level of confidence: Captures all logons

Installation: Easy—one or no installations. No reboot required. DC agent required: No Resources: Has own resources Scalability: Lower Redundancy: No Level of confidence: Might miss a logon (NetAPl), or have a delay (WinSeoLog)

DC agent mode requires one DC agent -----(1) installed on each Windows DC in the -------(2)