Quiz
FSSO I
Fragen in diesem Quiz (17)
1FSSO software identifies: (Select 3)
- AUser´s ID
- BIP Address
- CGroup Membership
- DGroup Users
- EComputers hostname
2Microsoft AD types mode:
- APolling mode
Agent mode - Bcollector agent-based
Agentless
- APolling mode
3Polling mode:
- ACollector agent-based
Agentless - BPolling mode
Agent mode
- ACollector agent-based
4In FSSO, FortiGate allows network access based on
- Aa. Active user authentication with username and password
- Bb. Passive user identification by user ID, IP address, and group membership
5Which working mode is used for monitoring user sign-on activities in Windows AD? 0
- Aa. Polling mode (collector agent-based or agentless)
- Bb. eDirectory agent mode
6DC Agent is responsible for:
- AMonitoring user logon events and forwarding them to the collector agents
Handling DNS lookups (by default) - BGroup veritication
Workstation checks
Updates of logon records on FortiGate
Sending domain local security group, organizational units (OUs), and global security group information to FortiGate
- AMonitoring user logon events and forwarding them to the collector agents
7Collector agent is responsible for:
- AGroup veritication
Workstation checks
Updates of logon records on FortiGate
Sending domain local security group, organizational units (OUs), and global security group information to FortiGate - BMonitoring user logon events and forwarding them to the collector agents
Handling DNS lookups (by default)
- AGroup veritication
8DC agent mode requires:
Two DC agent installed on each Windows DC
If you have multiple DCs, this means that you need multiple DC agents. DC agents monitor and forward user logon events to the collector agents.- ARichtig
- BFalsch
9Collector Agent sends: (Select 4)
- AUser name
- BHost name
- CIP address
- DUser groups(s)
- EMAC address
- FPorts
10Ports used for DC Agent
- AThe collector agent communicates with FortiGate over TCP port 8000 (default) and it listens on UDP port 8002 (default) for updates from the DC agents. The ports are customizable.
- BThe collector agent communicates with FortiGate over TCP port 8002 (default) and it listens on UDP port 8000 (default) for updates from the DC agents. The ports are customizable.
11Collector agents uses:
- ASMB TCP 445 protocol, by default, to request the event logs.
TCP 135, TCP 139, and UDP 137 as fallbacks - BSMB TCP 134 protocol, by default, to request the event logs.
TCP 135, TCP 139, and UDP 137 as fallbacks
- ASMB TCP 445 protocol, by default, to request the event logs.
12Three methods of the collector agent for collecting logon information:
- ANetAPI
- BWinSecLog
- CWMI
- DSMB
- ETCP
13Polls temporary sessions created on the DC when a user logs in or logs off and calls the NetSessionEnum function on Windows. It’s faster than the WinSec and WMI methods; however, it can miss some logon events if a DC is under heavy system load. This is because sessions can be quickly created and purged from RAM, before the agent has a chance to poll and notify Forthate.
- ANetAPl
- BWinSecLog
- CWMI
14Polls all the security event logs from the DC. It doesn't miss any logon events that have been recorded by the DC because events are not normally deleted from the logs. There can be some delay in FortiGate receiving events if the network is large and, therefore, writing to the logs is slow. It also requires that the audit success of specific event IDS is recorded in the Windows security logs. For a full list of supported event IDs, visit the Fortinet knowledge base site (http://kb.fortinet.com).
- AWlnSecLog
- BNetAPI
- CWMI
15 A Windows API that gets system information from a Windows server. The DC returns all requested logon events. The collector agent is a WMI client and sends WMI queries for user logon events to the DC, which, in this case, is a WMI server. The collector agent doesn't need to search security event logs on the DC for user logon events; instead, the DC returns all requested logon events. This reduces network load between the collector agent and DC.
- AWMI
- BNetAPI
- CWinSecLog
16Installation: Complex—multiple installations (one per DC). Requires reboot.
DC agent required: Yes
Resources: Shares with DC agents
Scalability: Higher
Redundancy: Yes
Level of confidence: Captures all logons- ADC Agent mode
- BPolling Mode
17Installation: Easy—one or no installations. No reboot required.
DC agent required: No
Resources: Has own resources
Scalability: Lower
Redundancy: No
Level of confidence: Might miss a logon (NetAPl), or have a delay (WinSeoLog)- ADC Agent mode
- BPolling Mode
Informationen
- Beschreibung
- Der Nutzer hat seine Fachbereichs-Information gelöscht. Quiz am FSSO I, erstellt von Gelöschter Nutzer am 11/04/2019.
- Autor
- Gelöschter Nutzer
- Sprache
- English
- Aufrufe
- 36
- Verlauf
- Erstellt am 11 Apr 2019 · aktualisiert am 11 Apr 2019
- Schlagwörter