Refer to the exhibit, which shows a partial output of the fssod daemon real-time debug command. What two conclusions can you draw Itom the output? (Choose two.)

Question

Options

• AThe workstation with IP 10.124.2.90 will be polled frequently using TCP port 445 to see if the user
• BThe logon event can be seen on the collector agent installed on Windows.
• CFSSO is using DC agent mode to detect logon events.
• DFSSO is using agentless polling mode to detect logon events.

• A
  76% (19)
• B
  16% (4)
• C
  8% (2)

Explanation

Options A and D are correct because the debug output reveals FSSO is operating in agentless polling mode - identified by the system actively polling the workstation at IP 10.124.2.90 over TCP port 445 (SMB/WMI). This is the defining characteristic of agentless polling: instead of relying on an installed agent to push logon events, the FSSO collector periodically queries endpoints using port 445 to discover who is logged in.

Why B is wrong: B describes DC agent mode behavior, where a collector agent installed on Windows captures logon events as they occur. Agentless mode has no installed agent - that's the entire point of it.

Why C is wrong: DC agent mode also has no TCP 445 polling behavior in the debug output; instead, it receives real-time event notifications pushed from the agent on the domain controller. Seeing active polling is a dead giveaway it's not DC agent mode.

Memory tip: Think "agentless = asks questions." Port 445 (SMB) is FSSO asking the workstation "who's logged in?" - polling is the substitute for having an agent do the reporting. If you see port 445 polling in a debug output, that always points to agentless mode.

No community discussion yet for this question.