FSCP Online Practice Questions

Explanation:
Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:
According to the Forescout HPS Inspection Engine Configuration Guide and HPS Applications Plugin documentation, the properties that can be determined by the HPS Plugin are: Operating System (C) and HTTP banner (E).
HPS Plugin Capabilities:
According to the HPS Inspection Engine guide:
"The HPS (Host Property Scanner) Inspection Engine provides host properties for detecting endpoint characteristics including operating system, services, and applications."
The HPS plugin determines:
Operating System - OS type, version, service pack level HTTP Banner - Service versions from HTTP banner scanning Services and Applications - Running processes and installed software System Information - Hardware vendor, NIC vendor, etc. Operating System Detection:
According to the HPS Applications Plugin guide:
"Windows operating system information is detected by the HPS Applications Plugin, including:
Release, Package/flavor, Service Pack"
The plugin detects:
Windows OS versions (XP, Vista, 7, 8, 10, etc.)
Server editions (2003, 2008, 2012, 2016, etc.)
Service pack levels
OS build information
HTTP Banner Detection:
According to the HPS Inspection Engine guide:
"Service Banner: Indicates the service and version information, as determined by Nmap. HTTP banner scanning returns service identification information."
The HTTP banner property is resolved by NMAP scanning with the -sV parameter, which is part of the HPS plugin's classification capabilities.
Why Other Options Are Incorrect:
A. Application installed on Mac OS - The HPS Applications Plugin is for Windows applications only; it does not detect Mac OS applications
B. External Device on Windows - External Device detection is a separate property unrelated to HPS plugin discovery
D. AD group membership - This is determined by the User Directory plugin via LDAP, not the HPS plugin
Mac OS Applications ✗ No macOS-specific
External Devices ✗ No Network discovery
Referenced Documentation:
CounterACT Endpoint Module HPS Inspection Engine Configuration Guide v10.8 CounterACT HPS Applications Plugin Configuration Guide v2.1.4 About the HPS Applications Plugin

Explanation:
Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:
Guest authentication is a User Directory feature. According to the Forescout Authentication Module Overview Guide and the User Directory Plugin Configuration Guide, the User Directory Plugin enables guest authentication and management through configured directory servers.
User Directory Plugin Features:
The User Directory Plugin (version 6.4+) provides the following core features:
Endpoint User Resolution - Resolves endpoint user details by querying directory servers
User Authentication - Performs user authentication via configured internal and external directory
servers (Active Directory, LDAP, etc.)
Guest Authentication - Enables authentication and registration of guest users on the network
Guest Sponsorship - Allows corporate employee sponsors to approve guest network access
Guest Management Portal - Provides functionality for managing guest hosts and guest portal access
Directory Server Integration - Integrates with enterprise directory servers for credential validation
Guest Management Capabilities:
The User Directory Plugin specifically enables:
Guest user registration and authentication
Guest approval workflows through sponsor groups
Guest session management
Guest password policies
Guest tag management for categorization
Why Other Options Are Incorrect:
B. Dashboard - This is a general console feature, not specific to the User Directory plugin
C. Radius authorization - This is the function of the RADIUS plugin, not the User Directory plugin (though they work together in the Authentication Module)
D. Query Switches - This is a function of the Switch plugin, not the User Directory plugin
E. Assets portal - This is a general Forescout platform feature, not specific to the User Directory plugin
Authentication Module Structure:
According to the documentation, the Authentication Module consists of two plugins:
RADIUS Plugin - Handles 802.1X authentication, authorization, and accounting
User Directory Plugin - Handles user resolution, authentication, and guest management
These work together but have distinct responsibilities. The User Directory Plugin specifically handles guest authentication among its feature set.
Referenced Documentation:
Forescout Authentication Module Overview Guide Version 1.1
About the User Directory Plugin documentation
User Directory Plugin Server and Guest Management Configuration Guide

Explanation:
Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:
According to the Forescout Resiliency Solutions User Guide and the Forescout Platform Installation Guide, High Availability (HA) requires a license. The documentation explicitly states:
"If your deployment is using Centralized Licensing Mode, you must acquire a valid ForeScout CounterACT Resiliency license. The Resiliency license supports: High Availability Pairing for Enterprise Manager is supported by the Forescout CounterACT See License."
High Availability Licensing Requirements:
According to the official documentation:
Per-Appliance Licensing Mode:
"The demo license for your High Availability system is valid for 30 days. You must install a permanent license before this period expires."
Centralized Licensing Mode:
"If your deployment is using Centralized Licensing Mode, you must acquire a valid ForeScout CounterACT Resiliency license for Appliances, or a CounterACT See License for Enterprise Manager High Availability Pairing."
License Usage Considerations:
According to the documentation:
"You should use the IP address of the High Availability pair when requesting a High Availability license"
"If a license is only issued to the Active node in a High Availability pair, the system may not operate after failover to the Standby node"
"Both nodes must be up when requesting a license"
Why Other Options Are Incorrect:
A. If HA reboots, this is an indication of a problem - According to the documentation, reboots can
occur during the setup process: "Following the second reboot in the high availability setup, allow time for data synchronization" - this is normal, not an indication of a problem
B. Set up HA on the Secondary node first - Incorrect order. According to the documentation, "Before you begin setting up the Secondary node Forescout Platform device, verify that the Primary node Forescout Platform device is powered on" - the Primary node must be set up first
C. Connect devices to the network and to each other - While devices must be connected, this is a general infrastructure requirement, not specific to HA setup. The more specific requirement is licensing
D. HA needs to be manually configured on the secondary appliance in order to sync correctly - According to the documentation, the Secondary node configuration uses a setup process that is distinct from the Primary node: "When setting up the Secondary node device, use the same sync interfaces and netmask settings used in the Primary node device" - this is guided setup, not manual configuration for sync
High Availability Setup Process:
According to the documentation:
Set up Primary Node - "Select High Availability mode: 1) Standard Installation 2) High Availability C Primary Node"
Set up Secondary Node - "Set up a device as the secondary node" (secondary node connects to primary automatically)
Licensing - "You must install a permanent license before this period expires"
Referenced Documentation:
Forescout Resiliency Solutions User Guide (v8.0)
Forescout Installation Guide v8.1.x
Forescout Resiliency and Recovery Solutions User Guide v8.1
Set up and configure a device as the primary node
Set up a device as the secondary node

Explanation:
Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:
According to the Forescout User Directory Plugin documentation, the two main uses of the User Directory plugin are: Verify authentication credentials (A) and Query user details (D).
Main Functions of User Directory Plugin:
According to the official documentation:
"The User Directory plugin resolves endpoint user details and performs user authentication via configured internal and external directory servers."
The plugin's two primary functions are:
Authenticate Users - Verify/validate authentication credentials
Resolve User Information - Query and retrieve user details from directory servers
Verifying Authentication Credentials:
According to the documentation:
The User Directory plugin:
Validates user credentials against configured directory servers (Active Directory, LDAP, etc.)
Performs authentication for:
Endpoint user authentication
Console login authentication
Guest user registration
RADIUS authentication
Querying User Details:
According to the documentation:
The User Directory plugin:
Resolves endpoint user information including:
User name and identity
Group membership
User properties and attributes
Department and organizational unit information
Retrieves details via LDAP queries when "Use as directory" is enabled
Why Other Options Are Incorrect:
B. Define authentication traffic - The plugin doesn't define traffic; it queries authentication servers for user information
C. Perform Radius authorization - This is the function of the RADIUS Plugin, not the User Directory plugin (though they work together)
E. Populate the Dashboard - Dashboard population is not a primary function of the User Directory plugin
User Directory vs. RADIUS Plugin:
According to the documentation:
Referenced Documentation:
User Directory plugin overview
About the User Directory Plugin
Initial Setup C User Directory

Explanation:
Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:
According to the Forescout Platform Administration Guide and Certificate Configuration documentation, Forescout uses the Online Certificate Status Protocol (OCSP) to verify the revocation status of certificates.
OCSP in Forescout:
According to the official Forescout documentation:
"You can also configure the use of Online Certificate Status Protocol (OCSP) and set up validation method failover between CRL and OCSP."
And further:
"The Forescout Platform supports certificate revocation lists (CRL) and Online Certificate Status Protocol (OCSP) for smart card authentication."
What OCSP Does:
According to the Wikipedia and Fortinet OCSP documentation:
"The Online Certificate Status Protocol (OCSP) is an Internet protocol used for obtaining the revocation status of an X.509 digital certificate."
OCSP provides:
Real-Time Status Verification - Checks current certificate revocation status
Request/Response Protocol - Sends a query to an OCSP responder
Revocation Status Response - Returns "good," "revoked," or "unknown"
Efficient Alternative to CRL - Smaller data payload than downloading full certificate revocation lists
How OCSP Works:
According to the OCSP documentation:
Request Sent - Client sends OCSP request to OCSP responder (server operated by CA) Status Verification - Responder checks revocation status with trusted CA Response Returned - Responder returns current status, revoked, or unknown
Decision Made - Application (like Forescout) accepts or rejects the certificate based on response
Forescout Smart Card Certificate Validation:
According to the Forescout documentation:
When using smart card authentication, Forescout:
Supports OCSP - Sends OCSP requests for certificate revocation status
Supports CRL - Also supports Certificate Revocation Lists as fallback
Failover Configuration - Can be configured to use OCSP with CRL fallback
OCSP vs. Certificate Revocation List (CRL):
According to the documentation:
Forescout uses OCSP because it provides real-time, efficient certificate status verification.
Why Other Options Are Incorrect:
A. PKI Certificate Revocation Protocol (PCRP) - This is not a standard protocol; PCRP does not exist
C. Online Revocation Status Protocol (ORSP) - This is not the correct name; the protocol is OCSP, not
ORSP
D. Certificate Revocation List Protocol (CRLP) - While Forescout supports CRL, the primary protocol for real-time status is OCSP
E. Certificate Revocation Protocol (CRP) - This is not a standard protocol; the correct protocol is OCSP Referenced Documentation:
Smart Card Certificate Configuration for Forescout Platform Using Forescout Platform Smart Card Authentication Client-Server Connection documentation Audit Actions - OCSP for Syslog validation
Online Certificate Status Protocol (OCSP) - Wikipedia What Is Online Certificate Status Protocol (OCSP) - Fortinet