Which of the following statements best describes how the collector agent learns that a user has logged off from the network?

While workstation inactivity might eventually lead to session timeout, it is not the primary or most accurate method for the collector agent to learn about an explicit user logoff event.

This describes the DC agent's role in capturing and forwarding events, but the question asks how the *collector agent* learns, which often involves polling or receiving from the DC agent which initially retrieved the event from DC event logs.

Workstations do not directly notify the DC agent or collector agent about logoffs; instead, logoff events are recorded in the domain controller's security event logs.

The collector agent actively polls the configured domain controllers (DCs) at regular intervals to retrieve security event logs, including logoff events (e.g., Event ID 4634 for user logoff), which it then uses to update user authentication status.