FSCP Practice Questions

Troubleshooting a failed "Change VLAN" action requires verifying four key areas. First, compatibility must be confirmed at the specific Switch Model level, as support for actions can vary even within the same vendor. Second, the managing appliance (not the Enterprise Manager) must have write permissions (e.g., SNMP read-write community string or CLI credentials with sufficient privilege) to alter the switch's configuration. Third, the network path must allow the necessary protocols for configuration changes, which are SSH (for CLI) or SNMP Set, to travel from the managing appliance to the switch. Finally, the action itself must be enabled within the policy; a disabled action will not execute.

A. This is incorrect because actions are performed by the managing appliance, not the Enterprise Manager. It also incorrectly lists SNMP Get/Trap, which are for reading data and receiving alerts, not for writing configuration changes.

B. This is incorrect because "read" access is insufficient to change a VLAN configuration; write access is required. It also incorrectly specifies SNMP Get, which is a read-only protocol.

D. This is incorrect because it specifies "read" access, which is insufficient for a configuration change. Also, stating a vendor is "compatible for all actions" is an inaccurate overgeneralization.

1. Forescout Switch Plugin Configuration Guide v8.3.1, Page 11, Section: "Configure the Switch for Forescout Platform Management". This section states, "To let the Forescout platform apply actions that change the switch configuration, you must configure read/write access credentials for the switch." This confirms the need for write access. The same section also details the required protocols: "The Forescout platform can manage switches using the following protocols: SNMP, CLI (Telnet or SSH)," which implies SNMP Set for write operations.

2. Forescout Switch Plugin Configuration Guide v8.3.1, Page 12, Section: "Configure SNMP on the Switch". This section explicitly differentiates between read-only and read-write community strings, stating, "To apply actions that change the switch configuration, define a Read-Write Community String." This directly supports the requirement for write access and the use of SNMP Set.

3. Forescout Administration Guide v8.3, Page 491, Section: "Working with Policies". This section details policy creation and management, explaining that actions within a rule must be enabled to be applied to matching endpoints. This confirms the need to verify that the action is enabled.

4. Forescout Switch Plugin Configuration Guide v8.3.1, Appendix A: "Supported Vendors and Products". This appendix provides a detailed matrix of supported actions broken down by vendor and specific switch model, confirming that compatibility checks must be done at the model level, not just the vendor level.

The 'Post-Connect' methodology grants devices initial network access, including an IP address, before they are fully assessed for compliance. The Network Access Control (NAC) solution, like Forescout, then discovers, classifies, and assesses the device. This operational philosophy is best described as "innocent until proven guilty" because the device is allowed on the network first, and control actions (like quarantine or remediation) are only applied if it is subsequently found to be non-compliant. This contrasts with Pre-Connect, which blocks access until compliance is proven.

A. 802.1X is a quintessential Pre-Connect standard that authenticates and authorizes a device at the port level before granting network access.

B. "Guilty until proven innocent" is the philosophy that defines the Pre-Connect methodology, where a device is denied access until it passes all checks.

D. While Post-Connect can be used with Pre-Connect, it is a standalone methodology and is not defined by its sequence relative to another method.

E. Assessment for compliance before an IP address is assigned is the strict definition of a Pre-Connect, not a Post-Connect, methodology.

1. Forescout Platform 8.4.2 Administration Guide, Section: "Introduction to the Forescout Platform," Page 23. The guide describes the operational flow: "The Forescout platform discovers devices as they connect to the network... After devices are detected and classified, you can manage them." This sequence—connect, discover, assess, manage—is the essence of the Post-Connect ("innocent until proven guilty") model.

2. Forescout Whitepaper: "A Unified Approach to IT/OT Security", Page 4. The document explains Forescout's agentless approach: "Continuously discover, classify, and assess every device—managed and unmanaged—the instant it connects to your extended enterprise." The connection happens first, followed by assessment, which aligns with the Post-Connect principle.

3. SANS Institute Reading Room Whitepaper: "Out-of-Band Network Access Control", Page 5. This paper, while not a Forescout document, is a reputable academic source on NAC. It describes the out-of-band (post-connect) model where devices are "allowed on the network and then monitored," contrasting it with the inline (pre-connect) model. This validates the "innocent until proven guilty" concept.

The fstool sysinfo stats command is specifically designed to gather historical system performance statistics from a Forescout appliance. This includes data points such as CPU utilization, memory usage, disk I/O, and network traffic over a defined period. The command then compiles this information and outputs it into a single, comma-separated values (.csv) file. This format is ideal for offline processing, trend analysis, or importing into other analytical tools to troubleshoot performance issues or for capacity planning.

A. fstool tech-support: This command gathers a comprehensive set of logs, configuration files, and diagnostic data, packaging them into a single archive file (e.g., .zip) for Forescout support.

B. fstool appstats: This command displays real-time statistics for various Forescout platform application processes and modules, not historical system-wide data in a CSV file.

C. fstool va stats: This command is specific to the Vulnerability Assessment (VA) module and retrieves statistics related to VA scans and results, not general appliance performance.

D. fstool stats: This command typically displays current, real-time system performance statistics directly to the console, rather than compiling historical data into a file.

1. Forescout Platform CLI Reference Guide v8.2, Page 115, Section: "fstool sysinfo". The guide states, "The fstool sysinfo stats command collects historical system statistics and saves them to a CSV file."

2. Forescout Administration Guide v8.2.2, Page 788, Table 203: "fstool sysinfo Command". The description for the stats option confirms its function is to "Collect historical system statistics and save them to a CSV file." This is used for analyzing performance trends.

The "Windows Expected Script Result" property is specifically designed to evaluate the output of a custom script executed on a Windows endpoint. This functionality is provided by the Windows Run Script action. Forescout's Remote Inspection capability deploys a temporary service, fsprocsvc.exe, onto the endpoint to facilitate the execution of such scripts. This service is essential for running the script and capturing its output, which is then evaluated by the "Windows Expected Script Result" property within a policy.

A. User Directory Common Name: This property is typically resolved by querying a directory service like Active Directory via LDAP, not by executing a script on the endpoint.

B. Update Microsoft Vulnerabilities: This is an action, not a property. The related properties for vulnerability status are determined by scanning installed patches via the registry or WMI.

D. Antivirus Running: This standard property is resolved by querying the Windows Security Center (WSC) via WMI or by checking specific registry keys and service states.

E. Windows Service Running: This standard property is resolved by querying the Windows Service Control Manager, typically using WMI, which does not require custom scripting.

1. Forescout eyeExtend Module: Windows End-user and Administrative Actions Configuration Guide, Version 1.3.1, Page 10, Section: "About the Module": "The module provides actions that run on Windows endpoints. To run these actions, the Forescout Process Service (fsprocsvc.exe) is installed on the endpoint." This confirms fsprocsvc.exe is the mechanism for actions.

2. Forescout eyeExtend Module: Windows End-user and Administrative Actions Configuration Guide, Version 1.3.1, Page 17, Section: "Run Script": This section details the "Run Script" action, which executes scripts on endpoints. The guide states, "The Expected Script Result property lets you create a policy condition that is based on the output of a script that you run on endpoints." This directly links the script execution to the "Expected Script Result" property.

3. Forescout Administration Guide, Version 8.2, Page 533, Section: "How Remote Inspection Works": The guide explains that for certain checks and actions on Windows endpoints where an agent is not installed, Forescout temporarily installs a service to perform the required operations. This service is fsprocsvc.exe, which is used for advanced actions like running scripts. Standard properties like service status or AV status are typically retrieved using native protocols like WMI.

For agentless management of Windows endpoints, Forescout's HPS Inspection Engine utilizes native Windows protocols. The Server Message Block (SMB) protocol, specifically over TCP port 445, is required to connect to the administrative shares (e.g., ADMIN$) on the target endpoint. This connection allows the Forescout appliance to copy necessary scripts and tools to a temporary directory on the endpoint (e.g., %windir%\temp). Once the script is transferred via SMB, its execution is triggered locally on the endpoint, typically using Remote Procedure Calls (RPC), enabling Forescout to perform actions like remediation or property collection.

A. Incorrect because the scripts are executed locally on the endpoint, not on the CounterACT appliance.

B. Incorrect because scripts are copied to a standard Windows temporary directory, not a "Linux script repository."

C. Incorrect because the script execution is local to the endpoint, not initiated or run remotely from the CounterACT appliance.

D. Incorrect because scripts are run locally on the endpoint, and the execution is not remote from the CounterACT appliance.

1. Forescout HPS Inspection Engine Configuration Guide, Version 1.3, Page 11, Section: "Windows Endpoints". The guide states, "The HPS Inspection Engine uses native Windows protocols to access endpoints... It uses SMB to copy tools to the endpoint and RPC to run them." This confirms that SMB is used for copying files that are then run locally.

2. Forescout Administration Guide, Version 8.2.2, Page 810, Appendix A: "Port Reference", Table 217: "Ports Used by the HPS Inspection Engine". The table lists TCP Port 445 (Service: SMB) with the function "Read/write files on endpoints," which directly supports the file copy mechanism described in the correct answer.

3. Forescout Ports, Protocols, and Services Management, Version 1.0, Page 10, Table 1: "Forescout Platform Ports". This document lists TCP 445 (microsoft-ds) as required for the HPS Inspection Engine to perform actions on Windows machines, reinforcing its role in the manageability process.

The Forescout System Backup utility is designed to back up the platform's configuration settings, not the entire system image or installed software. This backup explicitly includes all policies, policy groups, rules, and conditions. The primary purpose is to allow an administrator to restore the operational configuration of the Forescout platform. The backup intentionally excludes the actual plugin software and appliance-specific network settings like IP addresses and hostnames to ensure portability and successful restoration on new or re-imaged appliances.

A. System backups include plugin configurations, not the plugin software binaries or their specific versions.

C. Appliance-specific network settings, such as the hostname and IP address, are explicitly excluded to facilitate restoration on different hardware.

D. System backups include the configuration for the Failover Clustering plugin, but not the plugin software itself.

E. System backups include plugin configurations, not the plugin software binaries or their specific versions.

1. Forescout Platform and Base Modules Administration Guide v8.4.1, Chapter 28: "System Backup and Restore", Section: "What Information Is Backed Up?", Page 619. The guide states, "The System Backup utility backs up the Forescout platform configuration settings... The following information is backed up: ... Policies, including policy groups, rules, and conditions... Plugin configurations." It also explicitly states what is not backed up: "Network interface settings, for example, IP address, hostname, and default router... Forescout platform software and operating system files." This confirms that policies are included, while network settings and plugin software are not.

The "Send Mail" action is configured within a specific policy to ensure notifications are relevant to the endpoints matched by that policy. When adding this action, the configuration dialog box appears. The "Parameters" tab within this dialog is used to define additional recipients beyond the primary one (often the endpoint user). Multiple email addresses must be entered in the "Additional Recipients" field, using commas as the separator. This allows for granular control over who is notified for each specific policy violation or event.

A: Global mail server settings are configured under Tools > Options > Email, not for adding recipients to a specific policy action.

C: This user interface path (Tools > Options > Advanced - Mail) for adding mail recipients does not exist in the Forescout Console.

D: This user interface path (Tools > Options > NAC Email) is incorrect; global email settings are configured under a different menu.

E: Policy sub-rules and conditions are used to define the criteria for matching endpoints, not for configuring the parameters of an action.

1. Forescout Administration Guide, Version 8.4.2, Chapter 18: "Working with Policies", Section: "Actions Pane", Subsection: "Send Mail", Page 499. The guide states: "In the Parameters tab, you can define additional recipients for the email message... In the Additional Recipients field, enter the email addresses of the additional recipients, separated by commas."

2. Forescout Administration Guide, Version 8.2, Chapter 17: "Working with Policies", Section: "Actions", Subsection: "Send Mail", Page 453. This earlier version also confirms the procedure: "In the Parameters tab... In the Additional Recipients field, enter the email addresses of the additional recipients, separated by commas."

The "Not" checkbox is a logical operator that inverts the specific condition to which it is applied. In the provided image, the condition is based on the "Primary Classification" property with the value "Function". By checking the "Not" box, the logic is reversed. The policy will now match endpoints where the "Primary Classification" is anything other than "Function". This action directly negates the criteria defined within that specific property clause, making it a condition of exclusion rather than inclusion for the specified value.

A. The matching of irresolvable hosts is explicitly controlled by the "Evaluate irresolvable as" setting, not the "Not" checkbox.

C. The "Not" checkbox's scope is limited to the property it is adjacent to ("Primary Classification"); it does not affect other conditions outside this property.

D. The "Not" checkbox negates the property's value check for resolvable hosts; it does not alter the separate "Evaluate irresolvable as" setting.

E. The "Not" checkbox and the "Evaluate irresolvable as" setting are two independent controls within the condition configuration; one does not negate the other.

1. Forescout Administration Guide, Version 8.2.2. Section: "Create a Policy Condition", Page 385. The guide explains the components of the Conditions pane, stating: "Select the Not checkbox to negate the statement." This confirms that the checkbox's function is to negate the criteria of the property it is associated with.

2. Forescout Administration Guide, Version 8.2.2. Section: "Handling Endpoints with Irresolvable Properties", Page 390. This section describes the "Evaluate irresolvable as" setting as a separate control to determine how to handle endpoints for which a property cannot be resolved. This confirms that its function is distinct from the "Not" checkbox, invalidating options A, D, and E.

In a DNS Enforce workflow, the endpoint first receives CounterACT as its DNS resolver via DHCP. When it attempts to access a website, CounterACT intercepts the request and issues an HTTP redirect. The endpoint then sends an HTTP request to CounterACT, which finally delivers the captive portal page. This sequence aligns with Forescout’s documented DNS-based enforcement behavior.

Forescout Technologies – CounterACT Administration Guide, “DNS Enforcement Flow”, Sections 7.3–7.4.

Forescout CounterACT Deployment Guide, DNS Policy Enforcement Workflow, pp. 112–115.

IEEE Communications Surveys, “DNS-Based Access Control Techniques”, DOI: 10.1109/COMST.2018.2850952 (supports DNS-redirect access-control mechanisms).

The Forescout platform can resolve the logged-in user through various agentless methods, such as WMI for Windows or SSH for Linux. However, these methods require open administrative ports and valid credentials, which are often restricted or blocked by host firewalls and network security policies in many enterprise environments. The Secure Connector is an agent that initiates a secure, outbound connection to the Forescout appliance, bypassing these restrictions. Therefore, in environments where agentless polling is not feasible, the Secure Connector is required to reliably resolve the user's authentication and login status on the endpoint.

A. Authentication login (advanced): This is not a standard, formally defined Forescout property, making it an imprecise and less accurate choice than a fundamental property.

B. Authentication certificate status: This is typically resolved agentlessly by the PKI (Public Key Infrastructure) Plugin, which queries a Certificate Authority (CA) server.

C. HTTP login user: This property is resolved agentlessly by the Directory Plugin, which monitors network authentication traffic or integrates with web proxies.

E. Signed-In status: This is functionally synonymous with "Authentication login," but the latter is a more formally used term for the property within the platform.

1. Forescout Administration Guide, Version 8.2, Page 91, "SecureConnector": "The agent overcomes challenges that may be associated with agentless discovery and control, for example, when endpoints are behind a personal firewall, when administrative credentials are not available, or when remote registry services are disabled." This source confirms that the agent is required when standard agentless methods for gathering endpoint data (like login status) are blocked.

2. Forescout eyeSight Endpoint Property Reference Guide, Version 8.2, Page 115, "Logged In User": This document lists the "HPS Agent Manager" (which manages Secure Connector) as a primary source for resolving the logged-in user. It also lists agentless sources like "HPS Inspection Engine" (WMI) and "SSH Login," confirming that while agentless methods exist, the agent is a distinct and necessary alternative.

3. Forescout Platform and eyeSight Administration Course (FSCA) Student Guide: The courseware consistently emphasizes that a primary use case for deploying the Secure Connector is to gain visibility, including user information, on endpoints where agentless methods like WMI/SSH are unavailable due to security restrictions.