Which statement correctly describes NetAPI polling mode for the FSSO collector agent?

1. A. The collector agent uses a Windows API to query DCs for user logins.
2. B. NetAPI polling can increase bandwidth usage in large networks.
3. C. The NetSessionEnum function is used to track user logouts.
4. D. The collector agent must search Windows application event logs.

Correct Answer: B
NetAPI polling mode involves frequent queries to domain controllers, which can cause increased bandwidth usage, especially in large networks with many login events.

Refer to the exhibit.

Based on this partial configuration, what are the two possible outcomes when FortiGate enters conserve mode? (Choose two.)

1. A. Administrators cannot change the configuration.
2. B. FortiGate skips quarantine actions.
3. C. Administrators must restart FortiGate to allow new session.
4. D. FortiGate drops new sessions requiring inspection.

Correct Answer: BD
In fail-open mode, FortiGate skips quarantine actions to maintain traffic flow despite IPS or antivirus failures. FortiGate drops new sessions that require inspection when in conserve mode and fail-open is enabled, to
protect the network from potentially harmful traffic.

A network administrator enabled antivirus and selected an SSL inspection profile on a firewall policy.
When downloading an EICAR test file through HTTP, FortiGate detects the virus and blocks the file. When downloading the same file through HTTPS, FortiGate does not detect the virus and does not block the file, allowing it to be downloaded.
The administrator confirms that the traffic matches the configured firewall policy. What are two reasons for the failed virus detection by FortiGate? (Choose two.)

1. A. The selected SSL inspection profile has certificate inspection enabled.
2. B. The website is exempted from SSL inspection.
3. C. The El CAR test file exceeds the protocol options oversize limit.
4. D. The browser does not trust the FortiGate self-signed CA certificate.

Correct Answer: BD