Which two statements are true regarding heartbeat messages sent from an FSSO collector agent to FortiGate? (Choose two.)

Heartbeat messages are keepalives exchanged between the FSSO Collector Agent (CA) and the FortiGate to verify that the connection is active. These messages can be observed from both ends of the connection. On the FortiGate, enabling the FSSO real-time debug (diagnose debug application fsso -1 and diagnose debug enable) will display the heartbeat packets being received. On the Windows server running the Collector Agent, the agent's own log files (collectoragent.log) record these keepalive events, which is essential for troubleshooting from the server side.

A. The command diagnose debug authd fsso list is used to display the list of FSSO-authenticated users currently cached on the FortiGate, not for viewing real-time protocol messages.
D. Heartbeats are an intrinsic part of the FSSO communication protocol to maintain the connection state. They are enabled by default when the FSSO fabric connector is configured and do not require a separate manual command to be enabled.

Fortinet Single Sign-On (FSSO) 7.6.0 Administration Guide, page 51, "Troubleshooting > Collector agent debug log". This section describes the collectoragent.log file which contains information about keepalives sent to FortiGates.

FortiOS Handbook 7.6.1, User & Authentication Guide, "FSSO > FSSO troubleshooting". This section details the use of diagnose debug application fsso -1 to view communication between FortiGate and the collector agent, which includes heartbeats.