nerdexam
Fortinet

NSE4 · Question #385

In a FSSO agent mode solution, how does the FSSO collector agent learn each IP address?

The correct answer is D. The DC agent learns the workstation name from the event logs and DNS is then used to. In an FSSO agent mode solution, DC agents extract workstation names from event logs, and the FSSO Collector Agent then uses DNS to resolve these names to IP addresses.

Submitted by klara.se· Apr 18, 2026Firewall Policies and Authentication

Question

In a FSSO agent mode solution, how does the FSSO collector agent learn each IP address?

Options

  • AThe DC agents get each user IP address from the event logs and forward that information to
  • BThe collector agent does not know, and does not need, each user IP address. Only workstation
  • CThe collector agent frequently polls the AD domain controllers to get each user IP address.
  • DThe DC agent learns the workstation name from the event logs and DNS is then used to

How the community answered

(46 responses)
  • A
    4% (2)
  • B
    2% (1)
  • C
    2% (1)
  • D
    91% (42)

Why each option

In an FSSO agent mode solution, DC agents extract workstation names from event logs, and the FSSO Collector Agent then uses DNS to resolve these names to IP addresses.

AThe DC agents get each user IP address from the event logs and forward that information to

DC agents primarily identify user and workstation names from event logs; the direct IP address is typically resolved by the Collector Agent using DNS, rather than being directly provided by the DC agent from the logs.

BThe collector agent does not know, and does not need, each user IP address. Only workstation

The Collector Agent absolutely requires each user's IP address to create the essential user-to-IP mapping that the FortiGate uses for enforcing user-based security policies.

CThe collector agent frequently polls the AD domain controllers to get each user IP address.

In FSSO agent mode, the Collector Agent does not directly poll Active Directory for user IP addresses; it relies on information pushed by the DC Agents, which monitor event logs, and then performs DNS resolution.

DThe DC agent learns the workstation name from the event logs and DNS is then used toCorrect

In FSSO agent mode, the DC agent learns the workstation name associated with a user login event from the domain controller's security event logs and forwards this name to the Collector Agent, which then performs a DNS lookup to determine the corresponding IP address of the workstation.

Concept tested: FSSO agent mode IP learning

Source: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-handbook/368297/configuring-collector-agent-mode

Topics

#FSSO#Authentication#User-ID Mapping#Active Directory

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice