Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

While the collector agent uses Windows APIs to communicate with DCs, NetAPI polling primarily focuses on enumerating active sessions (for logouts) rather than solely querying for new user logins, which is more characteristic of event log polling.

Although NetAPI polling can increase bandwidth, especially in large environments, this statement describes a potential impact or drawback, not the fundamental mechanism or description of how NetAPI polling itself functions.

Searching security event logs on domain controllers is the mechanism used by FSSO's event log polling mode, not NetAPI polling mode.

The FSSO collector agent in NetAPI polling mode utilizes the NetSessionEnum Windows API function to query domain controllers and identify active user sessions, which helps in tracking user logouts when a session is no longer found. This method efficiently determines when users disconnect from network resources.