Study Guide – FSSO – FSSO with Windows Active Directory – Collector Agent-Based Polling Mode Options.
Collector agent-based polling mode has three methods (or options) for collecting logon info: NetAPI, WinSecLog and WMI.
NetAPI: Polls temporary sessions created on the DC when a user logs on or logs off and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some logon events if a DC is under heavy system load. This is because sessions can be quickly created and purged form RAM, before the agent has a chance to poll and notify FG.
A is the correct one. B has a conceptual trick in the answer. If you notice it says "...track users logouts" only. It does not even consider "login events". So, NetAPI polls when a user do both logs on or logs off (as you said) not just logs off.
In this case, according to the infrastructure study guide, the "Most Correct" answer between A and B is "B". Why? because explicitly in the guide it does not indicate that it consumes more bandwidth, only that it is polled every 9 seconds approximately, what it does indicate clearly is that the NetSessionEnum function is called when there is a log in "or" log out, the trick is in this "or". It is not a resounding if or only if of input/output, it is either log in "or" logout.
Correct:
B. The NetSessionEnum function is used to track user logouts.
FortiGate Infrastructure 7.2 Study Guide (p.128):
"NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate."
Incorrect:
A. NetAPI polling can increase bandwidth usage in large networks. (WinSecLog)
C. The collector agent must search security event logs. (WinSecLog)
D. The collector agent uses a Windows API to query DCs for user logins. (WMI)
Reference and download Study Guide for free & no sign-up:
https://ebin.pub/qdownload/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html
- WinSecLog: polis all the security event logs from the DC. It doesn't miss any login events that have been recorded by the DC because events are not normally deleted from the logs. There can be some delay in
FortiGate receiving events if the network is large and, therefore, writing to the logs is slow. It also requires that the audit success of specific event IDs is recorded in the Windows security logs. For a full list of supported event IDs, visit the Fortinet Knowledge Base (http://kb.fortinet.com).
- NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It's faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate.
Answer is B
page 127.
Infrastructure guide V-7.2
In this case, according to the infrastructure study guide, the "Most Correct" answer between A and B is "B". Why? because explicitly in the guide it does not indicate that it consumes more bandwidth, only that it is polled every 9 seconds approximately, what it does indicate clearly is that the NetSessionEnum function is called when there is a log in "or" log out, the trick is in this "or". It is not a resounding if or only if of input/output, it is either log in "or" logout.
Correct answer is B:
NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate.
Answer A is for WinSecLog:
WinSecLog: polls all the security event logs from the DC. It doesn’t miss any login events that have been recorded by the DC because events are not normally deleted from the logs. There can be some delay in FortiGate receiving events if the network is large and, therefore, writing to the logs is slow. It also requires that the audit success of specific event IDs is recorded in the Windows security
I think the correct answer is A
The FSSO NetAPI polling mode scans a Microsoft Windows domain controller every 9 seconds.
The NetAPI polling use the NetSessionEnum Microsoft API from netapi32.dll to detect the users that have established session on the domain controller.
It must be considered that the bandwidth usage is based on the concurrent logged-in users when the polling action is executed.
The other FSSO polling and DC Agent methods to calculate the bandwidth is not based on concurrent logged-in users but logged-in users per second.
https://community.fortinet.com/t5/FortiGate/Technical-Note-FSSO-NetAPI-polling-bandwidth-usage-calculator/ta-p/196417
According to Microsoft "The NetSessionEnum method MUST return information about sessions that are established on a server or return an error code".
It does not track logout events.
Actually... D is correct. TBH I dont think collector agent is programmed to watch for logout events, that is why it does workstation-checks. D itself is correct, since netapi uses windows-api
The NetAPI polling use the NetSessionEnum Microsoft API from netapi32.dll to detect the users that have established session on the domain controller. Means login NOT logout so A
Reading more about this (also see my other comments) it’s a reading exercise:
A. NetAPI polling can increase bandwidth usage in large networks: YES is correct, because more concurrent users, is more bandwidth, but not extremely high. But it will increase.
B. The NetSessionEnum function is used to track user logouts: YES its tracks user login AND logouts.
So, I’m still not sure how to answer this. A is strictly correct, but the infrastructure guide does not mention anything about bandwidth, only something about poll interval times. B is also correct because NetAPI uses NetSessionEnum end can track user logouts. But “function is used to track user logouts” suggests it’s only used for this. So I still feel like choosing aware B with my technical mind. But going on the text only I would go for A.
NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows.
Fortigate Infrastructure Study Guide7.0, Page 270
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
bccabrera
Highly Voted 1Â year, 2Â months agoJhonFenan
1Â year, 2Â months agoBUZOMD
10Â months, 1Â week agoVirutas
1Â year, 1Â month agonik110
Highly Voted 1Â year, 4Â months agoraydel92
Most Recent 4Â months, 2Â weeks agovelrisan
6Â months, 3Â weeks agoNet_Boy_26
10Â months agoNet_Boy_26
10Â months agoBUZOMD
10Â months, 1Â week agoalexeid72
11Â months, 3Â weeks agokosta_georgiev
12Â months agoEA_Prime
1Â year agotramollaaaa
1Â year agodosoriomartins
1Â year agoccnprs
1Â year, 2Â months agoSisCCA
1Â year, 1Â month agoORATILWE_05
1Â year, 2Â months agoFrankWithe
1Â year, 2Â months agonomeursy
1Â year, 3Â months agoKutchek
1Â year, 3Â months ago