Which of the following statements about NTLM authentication are correct? (Choose two.)

NTLM authentication allows a FortiGate to identify users authenticating against domain controllers that might not have a Fortinet Single Sign-On (FSSO) Collector Agent installed or monitored, extending user awareness capabilities in environments where FSSO isn't fully deployed.

When FSSO and NTLM are configured, FSSO is generally the primary and more efficient method for user identification, with NTLM often serving as a fallback or for specific legacy authentication scenarios.

In a multi-domain Active Directory environment, to achieve comprehensive user identification for NTLM (or FSSO), a Fortinet DC Agent must typically be installed on every domain controller in each domain to capture all relevant logon events across the entire infrastructure.

While NTLM authentication itself can occur with web browsers for specific applications, the FortiGate's NTLM user identification feature for policy enforcement does not inherently require an NTLM-enabled web browser; it captures NTLM authentication events from the network.