An administrator does not want to report the logon events of service accounts to FortiGate. What setting on the collector agent is required to achieve this?
A.
Add user accounts to the Ignore User List.
B.
Add the support of NTLM authentication.
C.
Add user accounts to the FortiGate group filter.
Correct:
A. Add user accounts to the Ignore User List.
FortiGate Infrastructure 7.2 Study Guide (p.144):
"The FSSO collector agent ignores any login events that match the Ignore User List entries. Therefore, these login events are not recorded by the collector agent, nor are they reported to FortiGate."
Reference and download study guide:
https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html
Study Guide – FSSO – FSSO Settings – Ignore User List.
The FSSO collector agent ignores any logon events that match the Ignore User List entries. Therefore, these logo events are not recorded by the collector agent, nor are they reported to FG.
It is a good practice to add all network service accounts to the Ignore User List. Service accounts tend to overwrite user logon events, and create issues with identity-based policy matching.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
raydel92
4 months, 2 weeks agoORATILWE_05
1 year, 2 months agobccabrera
1 year, 2 months agosteed47
1 year, 3 months agoMouhamadSalao
1 year, 4 months ago