What are two features of FortiGate FSSO agentless polling mode? (Choose two.)

In FortiGate FSSO agentless polling mode, the FortiGate unit directly polls the Domain Controllers (DCs) for user logon events. To accomplish this, the FortiGate uses the Server Message Block (SMB) protocol to remotely access and read the security event logs on each DC. This mode simplifies deployment as it does not require installing any agent software on the DCs. However, a known limitation of this direct polling method is its inability to perform advanced checks, such as the workstation check (also known as endpoint polling or NTLM check), which verifies if the user is still active on the machine.

A. In agentless polling mode, the FortiGate itself acts as the collector; there is no separate collector agent software involved for it to direct.

D. The FortiGate acts as the collector agent by polling the AD server (DC). The AD server is the source of the event logs, not the collector itself.

---

1. Fortinet FortiOS 7.4.0 Administration Guide

User & Authentication > FSSO > FSSO modes > Polling mode: "In this mode

the FortiGate polls the domain controller's (DC) event logs directly... The account must have rights to read the security event log on the DCs. This is typically done over SMB (CIFS)." This confirms that FortiGate polls directly using SMB.

2. Fortinet Single Sign-On (FSSO) 5.0.0 Administration Guide

Chapter 2: FSSO Modes > Polling Mode: "FortiGate polls the DC for user logon events. This mode does not require an agent on the DC

but it is slower than DC Agent mode. It also does not support workstation check." This explicitly states that workstation check is not supported in this mode.

3. Fortinet FortiOS 7.2.0 Administration Guide

User & Device > FSSO > FSSO modes > Polling mode: The guide details the configuration steps which require an administrator account with permissions to access the DC's event log

implicitly confirming the remote access mechanism (SMB) and the absence of a separate collector agent. The limitations section often contrasts this mode with the full-featured DC Agent mode

which includes workstation checks.