FSCP Exam Dumps : Forescout Certified Professional Exam

Based on the image showing "Meets the following criteria" radio button selected (as opposed to "Does not meet the following criteria"), the correct statement is: "Has no effect on irresolvable hosts".​

Understanding "Meets the following criteria":

According to the Forescout policy configuration documentation:​

When "Meets the following criteria" is selected:

Normal Evaluation - The condition is evaluated as written

No Negation - There is NO inversion of logic

Irresolvable Handling - Separate setting; the "Meets" choice does NOT affect irresolvable handling

Irresolvable Hosts - Independent Setting:

According to the policy sub-rule advanced options documentation:​

"The 'Meets the following criteria' radio button and the 'Evaluate irresolvable as' checkbox are independent settings."

"Meets the following criteria" - Controls normal/negated evaluation

"Evaluate irresolvable as" - Controls how unresolvable properties are treated

The selection of "Meets the following criteria" has no specific effect on how irresolvable hosts are handled.

Why Other Options Are Incorrect:

B. Generates a NOT condition - "Meets" does NOT generate NOT; it's the normal condition

C. Negates the criteria outside - "Meets" does not negate anything; it's the affirmative option

D. Modifies irresolvable condition to TRUE - The "Evaluate irresolvable as" setting controls that, not "Meets"

Referenced Documentation:

Define policy scope​

Forescout eyeSight policy sub-rule advanced options​

Forescout Platform Policy Sub-Rule Advanced Options​

Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:

According to the Forescout CounterACT HPS Inspection Engine Configuration Guide Version 10.8, when the Endpoint Remote Inspection method is set to "Using MS-WMI," scripts are run using WMI, but they may not be run interactively using this method.​

MS-WMI Script Execution:

According to the HPS Inspection Engine guide:​

"When Remote Inspection uses MS-WMI, run scripts with

MS-WMI – note that interactive scripts are not supported by WMI on all Windows endpoints. Functionality that relies on interactive endpoint scripts is not implemented when you choose this option. For example, the Start Antivirus and Update Antivirus actions require interactive scripts to manage some antivirus packages."

Interactive Script Limitations with WMI:

According to the documentation:​

"WMI does not support interactive scripts (such as scripts that support Guest Registration and other HTTP-based actions) on some Windows endpoints."

How WMI Scripts Are Run:

According to the documentation:​

When using WMI for script execution:

Background Scripts - Most background scripts can run via WMI

Interactive Scripts - NOT supported by WMI on all endpoints

Workaround for Interactive Scripts - CounterACT uses:

fsprocsvc service (fsprocsvc.exe) - For interactive script support

Microsoft Task Scheduler - Alternative for interactive scripts

WMI vs. Other Methods:

According to the documentation:​

Method

Interactive Scripts

Limitations

MS-WMI

Not supported on all endpoints

Limited to background scripts

fsprocsvc

Supported

Service must be running

Task Scheduler

Not on Vista/7

Legacy OS limitations

Script Execution Flow with MS-WMI:

According to the documentation:​

"CounterACT runs most background scripts using WMI. WMI does not support interactive scripts (such as scripts that support Guest Registration and other HTTP-based actions) on some Windows endpoints. CounterACT uses the fsprocsvc service or Microsoft Task Scheduler to run interactive scripts on these endpoints."

Why Other Options Are Incorrect:

A. Using Task Scheduler but with limitations - Task Scheduler is an ALTERNATIVE to WMI, not what MS-WMI uses

B. Using WMI, which will allow interactive scripts - Incorrect; WMI does NOT allow interactive scripts

C. Using RRP, which will allow interactive scripts - RRP is Remote Registry Protocol, not the script execution method with MS-WMI

E. Using fsprocserv.exe, but scripts may not be run interactively - fsprocserv.exe (fsprocsvc) DOES support interactive scripts; it's used as an alternative to overcome WMI limitations

Referenced Documentation:

CounterACT Endpoint Module HPS Inspection Engine Configuration Guide v10.8 - Script Execution Services section​

When Remote Inspection uses MS-WMI, run scripts with​

About MS-WMI​

Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:

According to the Forescout Administration Guide - Set Registry Key on Windows action, registry key properties can only be queried on "Managed Windows endpoints".​

Registry Key Property Requirements:

According to the Set Registry Key on Windows documentation:​

"Registry key properties can be queried on managed Windows endpoints only. The endpoint must be a Windows device that is managed (either via SecureConnector deployment or Remote Inspection with appropriate credentials)."

Managed vs. Unmanaged Endpoints:

According to the Windows Properties documentation:​

Managed Windows Endpoint -✓Can query registry keys

Has SecureConnector deployed, OR

Has Remote Inspection access via credentials, OR

Is domain-joined with appropriate permissions

Unmanaged Windows Endpoint -✗Cannot query registry keys

No agent or access method available

Registry cannot be accessed remotely

Why Other Options Are Incorrect:

A. Managed unknown endpoint - "Unknown" endpoints are not classified as Windows; classification unknown

B. Unmanaged Windows endpoint - Unmanaged endpoints have no access to registry

D. Windows endpoint - Must be "managed" to query registry; not all Windows endpoints are managed

E. Managed Linux endpoint - Linux systems don't have Windows registry

Registry Access Methods:

According to the documentation:​

Registry keys can be queried on Managed Windows endpoints using:

SecureConnector - Preferred method for interactive registry access

Remote Inspection (MS-WMI/RPC) - When credentials are configured

Domain Credentials - When endpoint is domain-joined

Referenced Documentation:

Set Registry Key on Windows - v9.1.4​

Set Registry Key on Windows - v8.5.2​

Windows Properties​