Which two statements about advanced AD access mode for the FSSO collector, agent are true? (Choose two.)

The FSSO Collector Agent's Advanced AD access mode uses LDAP to communicate with Active Directory domain controllers. This method is more robust than the Standard mode. A key advantage of using LDAP is its ability to resolve nested group memberships, allowing for more complex and realistic group structures to be monitored for policy enforcement. Additionally, Advanced mode retrieves more comprehensive user information, including both the sAMAccountName and the domain, which it then sends to the FortiGate using the standard Windows naming convention of Domain\Username.

A. The FSSO Collector Agent, not the FortiGate, acts as the LDAP client to query Active Directory and apply the configured group filters.

D. The AD access mode (Standard vs. Advanced) is a setting on the Collector Agent for querying user group information and is independent of the logon detection method (DC Agent mode vs. Polling mode).

1. Fortinet Single Sign-On 5.0.0303 Administration Guide

Page 31

Section: "Collector agent advanced settings > Active Directory (AD) access mode".

"Advanced The collector agent uses LDAP to connect to the DC. This is more reliable than Standard mode. It also supports nested groups." (This supports option C).

2. Fortinet Single Sign-On 5.0.0303 Administration Guide

Page 32

Section: "Collector agent advanced settings > User name".

"In Advanced mode

the collector agent gets the user's sAMAccountName and domain from the DC

and sends them to the FortiGate unit in the format: \." (This supports option B).

3. FortiOS 7.0.0 Administration Guide

Page 1118

Section: "FSSO modes".

The guide distinguishes between logon detection modes (DC Agent vs. Polling) and the Collector Agent's AD access mode

confirming they are separate configurations. This implicitly refutes option D. The section on Advanced mode also reiterates its support for nested groups.