Which of the following statements describe WMI polling mode for the FSSO collector agent? (Choose two.)

WMI polling primarily focuses on querying active user sessions rather than explicitly using `NetSessionEnum` for logoffs, and logoff tracking in FSSO often involves other mechanisms or timeout settings.

While any polling can consume bandwidth, WMI polling is generally considered less impactful than event log polling in terms of constant data transfer and can be optimized, and it's not its primary defining characteristic.

In WMI polling mode, the FSSO collector agent uses WMI (Windows Management Instrumentation) queries, which are essentially Windows API calls, to directly retrieve user login information from Domain Controllers by actively pulling data.

WMI polling mode directly queries Domain Controllers for user login status using WMI calls, meaning it does not need to parse or search security event logs for login/logoff events, differentiating it from event log polling.