NSE4 · Question #53
Which statement is one disadvantage of using FSSO NetAPI polling mode over FSSO Security Event Log (WinSecLog) polling mode?
The correct answer is C. It might miss some logon events. A disadvantage of FSSO NetAPI polling is that it might miss some logon events because it relies on actively polling domain controllers for user sessions, which can be less reliable than event-driven methods.
Question
Which statement is one disadvantage of using FSSO NetAPI polling mode over FSSO Security Event Log (WinSecLog) polling mode?
Options
- AIt requires a DC agent installed in some of the Windows DC.
- BIt runs slower.
- CIt might miss some logon events.
- DIt requires access to a DNS server for workstation name resolution.
How the community answered
(27 responses)- A4% (1)
- B7% (2)
- C89% (24)
Why each option
A disadvantage of FSSO NetAPI polling is that it might miss some logon events because it relies on actively polling domain controllers for user sessions, which can be less reliable than event-driven methods.
NetAPI polling mode is an agentless method and does not require a DC agent installed on Windows DCs.
While NetAPI polling can have latency, its primary technical disadvantage compared to WinSecLog is the potential to miss login events due to its polling nature rather than being strictly 'slower' overall.
NetAPI polling mode queries domain controllers for active user sessions at configured intervals, meaning there can be a delay between a user logging on and the FortiGate recognizing the event, potentially leading to missed or delayed logon events, especially for short-lived sessions.
Both NetAPI and WinSecLog polling modes generally benefit from or require DNS resolution for accurate user-to-IP mapping, so this is not a unique disadvantage of NetAPI.
Concept tested: FSSO polling modes disadvantages
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526738/fortinet-single-sign-on-fsso
Topics
Community Discussion
No community discussion yet for this question.