NSE 4 - FortiOS 7.6 Administrator Exam Materials - Question #34 Discussion

Fortinet Guru (blog explaining FSSO in polling mode):

Polling mode has three options: NetAPI, Event Log, and WMI.
NetAPI polling retrieves server logon sessions using NetSessionEnum. It’s faster but may miss some user logon events under heavy load Fortinet Community+6Fortinet GURU+6Reddit+6.
Importantly, it does not mention tracking logouts. It only polls active sessions at that moment—it can detect that a user has logged on (active session), but not explicitly “logouts.”

Incorrect statement: “The NetSessionEnum function is used to track user logouts.”
There’s no official documentation supporting that NetSessionEnum actively tracks logouts—it merely returns the current active sessions.

The FSSO NetAPI polling mode scans a Microsoft Windows domain controller every 9 seconds.
The NetAPI polling use the NetSessionEnum Microsoft API from netapi32.dll to detect the users that have established session on the domain controller.
It must be considered that the bandwidth usage is based on the concurrent logged-in users when the polling action is executed.
The other FSSO polling and DC Agent methods to calculate the bandwidth is not based on concurrent logged-in users but logged-in users per second.

https://www.fortinetguru.com/2016/07/fsso-for-windows-ad/
https://community.fortinet.com/t5/FortiGate/Technical-Note-FSSO-NetAPI-polling-bandwidth-usage-calculator/ta-p/196417?utm_source=chatgpt.com

C is correct, NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some login events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify FortiGate. page 154 study guide

7.6 Study Guide Page 182
"NetAPI: polls temporary sessions created on the DC when a user logs in or logs out and calls the
NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can
miss some login events if a DC is under heavy system load. This is because sessions can be quickly
created and purged from RAM, before the agent has a chance to poll and notify FortiGate."

34

NetAPI polling uses functions like NetWkstaUserEnum to query active user sessions. It does not rely on NetSessionEnum for logout tracking.

what is tyhe correct answer @admin ?