https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-troubleshoot-FSSO-agentless- polling/ta-p/214349 From the snippet we can see that FortiGate (via the fssod daemon) is directly detecting the user logon rather than relying on a separate "collector" or "DC agent." This indicates agentless polling-FortiGate polls the DC's event logs over TCP 445 to discover logons. So: - FSSO is using agentless polling mode to detect logon events - In agentless mode, FortiGate will periodically poll the same IP (the DC) on port 445 to see if the user is still logged on

We must analyze the flags (*, >, S, O, B) and Administrative Distances (AD) shown in the get router info routing-table database exhibit to determine the correct statements.
* Analysis for Option A (The BGP route to 10.0.4.0/24 is not in the forwarding information base):
* True. Look at the entry for 10.0.4.0/24.
* There is an OSPF route: O *> 10.0.4.0/24 [110/2]. The * indicates it is in the FIB, and > indicates it is the selected route.
* There is a BGP route: B 10.0.4.0/24 [200/10]. This line lacks the * flag.
* Reason: The OSPF route has an Administrative Distance of 110. The BGP route (iBGP) has an AD of 200. Since 110 is lower than 200, OSPF wins, and the BGP route is not installed in the Forwarding Information Base (FIB).
* Analysis for Option B (The default static route through 10.200.1.254 is in the forwarding information base):
* True. Look at the 0.0.0.0/0 entries.
* The first entry is S *> 0.0.0.0/0 [10/0] via 10.200.1.254.
* The * flag confirms this specific route is installed in the FIB.
* The second static route (via 10.200.2.254) has a higher distance ([20/0]) and no * flag, so it is inactive.
* Why C is False: ECMP (Equal Cost Multi-Path) requires routes to have the same cost/priority. Here, one static route has AD 10 and the other has AD 20. They are not equal, so ECMP is not performed.
* Why D is False: The routing table database shows active routes, not the raw Link State Advertisement (LSA) database. You cannot determine the number of LSAs received solely from this output.
Reference:
FortiGate Security 7.6 Study Guide (Routing): "The routing table database displays all known routes... The
* indicates the route is in the FIB... Lower Administrative Distance is preferred."

According to Fortinet's LDAP authentication workflow as described in the FortiOS Administration Guide and the official LDAP debug log interpretation, each authentication attempt is split into several key steps: Bind Request, Search Request, and then, if successful, a Bind as the found user DN. In the provided debug output, we see "start search_dn-base" with a filter "sAMAccountName=jsmith" and the log line "Going to SEARCH state," confirming that FortiOS is in the second step-the Search Request (Option D). Official documentation highlights this exact phrase "SEARCH state" as indicative of Step 2 within the LDAP process ("Bind # Search # Bind").
Additionally, the last line "Found DN 1: CN=John Smith, CN=Users, DC=TAC, DC=ottawa, DC=fortinet, DC=com" verifies that the system has successfully mapped the username to the Distinguished Name (DN) and this user is "John Smith." The authentication will now proceed using this mapped user (Option B).
Fortinet's logs record the found DN after a successful search, which is a strong confirmation that the user's credentials can be validated against the found DN.
Options A and C are not supported directly by the debug output shown:
* The server name "Lab" is referenced as part of the request, but not explicitly as the LDAP server's configured name in this output.
* Step 3 (Bind Request) would follow finding the DN, but the log here demonstrates the Search and DN found-per Fortinet, this precedes the actual Bind/validation step.
References:
FortiOS Administration Guide: LDAP Authentication Process and Debug Logs Fortinet Official KB: LDAP Integration Workflow and Log Interpretation