View all questions & answers for the NSE 4 - FortiOS 7.6 Administrator Exam Materials exam


Question 37 Discussion

Which statement correctly describes NetAPI polling mode for the FSSO collector agent? (Choose one answer)

  • A. The collector agent uses a Windows API to query DCs for user logins.
  • B. NetAPI polling can increase bandwidth usage in large networks.
  • C. The NetSessionEnum function is used to track user logouts.
  • D. The collector agent must search Windows application event logs.
Correct Answer: C

Brave-Dump Clients Votes

C 66.67%
A 33.33%

Comments



Miroslaw Lerch 2025-09-01 11:41:50

Selected Answers: A


Fortinet Guru (blog explaining FSSO in polling mode):

Polling mode has three options: NetAPI, Event Log, and WMI.
NetAPI polling retrieves server logon sessions using NetSessionEnum. It’s faster but may miss some user logon events under heavy load Fortinet Community+6Fortinet GURU+6Reddit+6.
Importantly, it does not mention tracking logouts. It only polls active sessions at that moment—it can detect that a user has logged on (active session), but not explicitly “logouts.”

Incorrect statement: “The NetSessionEnum function is used to track user logouts.”
There’s no official documentation supporting that NetSessionEnum actively tracks logouts—it merely returns the current active sessions.

The FSSO NetAPI polling mode scans a Microsoft Windows domain controller every 9 seconds.
The NetAPI polling use the NetSessionEnum Microsoft API from netapi32.dll to detect the users that have established session on the domain controller.
It must be considered that the bandwidth usage is based on the concurrent logged-in users when the polling action is executed.
The other FSSO polling and DC Agent methods to calculate the bandwidth is not based on concurrent logged-in users but logged-in users per second.

https://www.fortinetguru.com/2016/07/fsso-for-windows-ad/
https://community.fortinet.com/t5/FortiGate/Technical-Note-FSSO-NetAPI-polling-bandwidth-usage-calculator/ta-p/196417?utm_source=chatgpt.com

Mr_Fortitito 2025-09-10 00:52:18

Selected Answers: C


C is correct, NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate. page 154 study guide

Vic Geek 2025-12-18 03:54:01

Selected Answers: C


7.6 Study Guide Page 182
"NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the
NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can
miss some login events if a DC is under heavy system load. This is because sessions can be quickly
created and purged from RAM, before the agent has a chance to poll and notify FortiGate."
  • Rodrigo 2026-01-28 23:53:37
    Thank you, i confirmed on study guide...thanks!