NSE 4 – FortiGate 5.4 — Question 52

Which of the following statements best describes how the collector agent learns that a user has logged off from the network?

Answer options

• A. The workstation fails to reply to the polls frequently done by the collector agent.
• B. The DC agent captures the log off event from the event logs, which it forwards to the collector agent.
• C. The work station notifies the DC agent that the user has logged off.
• D. The collector agent gets the logoff events when polling the respective domain controller.

Correct answer: D

Explanation

The correct answer is D because the collector agent retrieves logoff events by polling the domain controller, which keeps track of user sessions. Options A, B, and C are incorrect as they either misrepresent the polling mechanism, suggest an unreliable notification method, or rely on event log capturing, which is not how the collector agent learns about logoffs.