Forescout FSCP Exam Prep
Forescout Certified Professional (Page 4 )

• The servers are powered on.
• The network is functioning.
• Devices can still reach the server network.

• ARP poisoning: Redirects or intercepts local network traffic; it usually affects communication paths rather than overwhelming a service.
• Jamming: Disrupts wireless or radio signals. It would not fit a system that remains accessible from devices on the server network.
• Kerberoasting: Attempts to crack service-account credentials from Kerberos tickets; it does not normally cause an immediate outage.

• Actual filename: Document.xml.txt
• Explorer displays: Document.xml
• File type: Text Document (.txt)

text 
Document.txt ? Document.xml

• Compensating control: The server is end-of-life, so it may no longer receive security patches or support. Placing it on a restricted VLAN provides an alternative layer of protection by reducing who can access it and limiting its exposure.
• Technical control: VLAN segmentation and access control lists (ACLs) are technology-based mechanisms that enforce network access restrictions automatically.

• Managerial: Policies, procedures, and governance—not network configuration.
• Physical: Locks, guards, or barriers.
• Corrective: Restores systems after an incident.
• Detective: Identifies suspicious activity rather than restricting access.
• Deterrent: Discourages behavior but does not enforce access rules.

• MAC flooding: Overwhelms a switch’s MAC address table, potentially causing traffic to be broadcast.
• DNS spoofing: Provides false DNS responses to redirect users.
• ARP poisoning: Sends false ARP information to associate an attacker’s MAC address with another device’s IP address.

• OpenID Connect (OIDC) is an authentication layer built on OAuth 2.0.
• It returns an ID token, normally a JWT containing identity claims such as the user’s subject, name, email, or other permitted attributes.
• The wellness application can consume those claims without needing a separate user-information call.

• JWT Bearer Token Flow: intended for server-to-server authorization and does not primarily provide an end-user ID token.
• Web Server Flow: is an OAuth authorization-code flow. It can be used with OIDC in some implementations, but “Web Server Flow” alone does not specifically guarantee an ID token.
• User Agent Flow: describes an OAuth flow, not the identity protocol itself.

• User preferences change, so the model must learn from recent data.
• Keeping the existing data helps preserve knowledge of older patterns and provides a broader training distribution.
• Training only on new data can cause catastrophic forgetting and may overfit if the new dataset is small.
• The new data should not automatically be used as the test set, because it is needed for training and the model must still be evaluated on separate, representative data.

• 2000::/3 — Global unicast, used for publicly routable IPv6 addresses.
• FC00::/7 — Unique local, used for private internal addressing.
• FE80::/10 — Link-local, used only on the local network segment and not routed between subnets.

• Restrict a port to a defined number of MAC addresses
• Use statically configured or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious traffic but is not the primary control for switch-port MAC limits.
• NGFW: Filters routed network traffic, not the switch’s CAM/MAC address table directly.

• Date: 2018-12-31
• Time: 08:59

• B: The original value contains the text at, so it cannot be converted directly to a date.
• A: The last characters contain the time, not the date.
• D: Extracting the first 11 characters can leave an unwanted space and does not properly separate the time component.

• Supervised learning requires labeled examples to learn how to classify customers.
• Reinforcement learning learns through actions, rewards, and penalties, which is not the main task here.
• RLHF uses human feedback to improve model behavior, typically for generative AI, not customer segmentation.

• Tactics: The attacker’s overall goal, such as gaining persistence or exfiltrating data
• Techniques: The methods used to achieve that goal
• Procedures: The specific implementation or sequence of actions

• IP addresses and hash values: Useful indicators, but they can change quickly.
• Indicators of compromise: TTPs may help identify IOCs, but their main value is describing behavior.
• Tools: Attackers can replace tools or use legitimate administrative utilities.

• Matching hashes: The software is unchanged.
• Different hashes: The software was modified or corrupted.

• Encryption: Protects confidentiality.
• Baselines: Define approved configurations or normal performance.
• Tokenization: Replaces sensitive data with tokens.

• Primary and core nodes: Use On-Demand Instances because the workload is business-critical. These nodes manage the cluster and store/process HDFS data.
• Task nodes: Use Spot Instances in an instance fleet. Task nodes are suitable for interruption because they do not hold essential cluster data and can be replaced or diversified across instance types.
• Terminate the entire cluster after processing: The job runs only about six hours each morning, and EMRFS stores data in Amazon S3. Keeping the cluster running for the rest of the day would waste money.

• A: Using Spot for primary and core nodes risks interruption of the critical cluster.
• C: All On-Demand is reliable but unnecessarily expensive; terminating the cluster helps, but Spot task nodes provide greater savings.
• D: Leaving primary and core nodes running after the task finishes continues to incur costs. Savings Plans also are less appropriate for this intermittent workload.

Simple explanation

• The Azure VPN gateway to connect to
• Authentication settings
• Routes for networks that the client can access

• Voice devices ? VLAN 10
• Data devices ? VLAN 20
• SVI for VLAN 10 ? 192.168.10.1
• SVI for VLAN 20 ? 192.168.20.1

• A: Describes a physical trunk interface, not an SVI.
• B: An SVI can provide management access, but that is not its primary definition here.
• D: SVI does not compensate for insufficient physical ports; it is a logical interface.

• Sending calls to available agents quickly
• Balancing interactions across agents
• Preventing calls from being handled manually one at a time

• Workforce Management: Forecasts demand and schedules enough staff; it supports wait-time reduction but does not directly distribute calls.
• Skill-based Routing: Routes calls based on agent skills and may improve the customer experience, but the question is asking about the core feature that distributes calls efficiently.
• IVR: Lets callers navigate menus and self-service options; it does not primarily assign calls to agents.

• Database data: Aggregates are used to retrieve structured data, commonly from entities and database sources.
• Screen scope: A Screen Aggregate belongs to the screen where it is defined and is not directly reusable as a screen-level aggregate elsewhere.
• Asynchronous and parallel execution: Multiple Screen Aggregates can run asynchronously and in parallel, helping the screen load data efficiently.

• Documented and evaluated
• Assessed for security, cost, and operational impact
• Reviewed and approved by the appropriate personnel
• Tested before implementation
• Tracked with version history and rollback procedures

• Risk management process: May help assess the issues, but it does not authorize and manage design changes.
• Product design process: Applies primarily while creating a new design.
• Design review process: Normally evaluates a design before release; this design is already released.

• Identified risks
• Risk owners or responsible parties
• Likelihood and impact
• Risk response plans
• Current status
• Risk thresholds or trigger conditions

• Risk tolerance: The amount and type of risk an organization is willing to accept; it is not primarily a tracking document.
• Risk transfer: Moving the financial or operational impact of a risk to another party, such as through insurance or outsourcing.
• Risk analysis: The process of evaluating a risk’s likelihood and impact.

• Replaces the verbal message — this describes non-verbal communication being used instead of words.
• Substitutes for verbal communication — similar; it means communicating without speech.
• Confuses the verbal message — this occurs when non-verbal signals contradict or obscure the spoken message.

• Remote and global access: Employees can authenticate from anywhere, not just a specific location.
• Seamless login: The device can authenticate in the background, reducing repeated password or MFA prompts.
• Minimal equipment: It uses devices employees already have, rather than requiring separate hardware.

• Geotagging: Identifies location but is not a complete authentication method and can be spoofed.
• Smart cards: Can provide strong authentication, but require cards and often readers, adding equipment and user steps.
• Time-based logins: Restrict access by time but do not verify the user or device adequately.

• Microsoft Teams: Connects to Teams-related data, but it isn’t the primary connector for the Power Apps data tables.
• Personal Analytics: Provides personal productivity insights, not application data.
• SQL Server database: Only applies if the app explicitly uses SQL Server as its data source.
• Dataflows: Used for preparing and centralizing data, not as the normal direct connection to a Power Apps app.

• A — Too infrequent: Formal strategies are often reviewed only every three to five years. This can make the organisation slow to respond to rapid changes in technology, competitors, regulation or customer needs.

• C — Relies on predicting the future: The approach assumes senior managers can make reasonably reliable forecasts and assumptions. In uncertain environments, these assumptions may quickly become invalid.

• E — Can restrict radical innovation: Formal planning tends to favour existing information, established objectives and incremental improvements. This may discourage experimental or highly innovative strategies that emerge from lower levels of the organisation.

• B concerns the difficulty of achieving competitive advantage through core competences when competing with focused specialists. It is not specifically a drawback of the formal top-down planning process.
• D is an activity organisations should undertake—continuous monitoring—not a drawback of the approach itself.

• netstat: Shows local network connections and listening ports, but not which WAN path carries the traffic.
• nslookup: Resolves domain names to IP addresses.
• ping: Tests reachability and latency but does not show the route.

• Online payment fraud
• Account takeover
• Fake account creation
• Suspicious transactions

1. Find the subnet-mask increment in the octet where the prefix ends.
2. Identify the network address by finding the subnet boundary at or below the given IP.
3. The first usable address is network address + 1.
4. The broadcast address is one address before the next subnet.
5. The last usable address is broadcast - 1.

• 172.28.228.144/18

• 172.28.228.144/23

• Secure: uses encryption, such as HTTPS or SFTP.
• Cross-platform: supported by many languages and operating systems.
• Internet-friendly: designed to communicate across networks, usually using standard Internet protocols.

• JSON/REST over HTTPS — widely supported, secure, and Internet-friendly.
• SOAP over HTTPS — also secure and highly cross-platform, though more heavyweight.
• XML over SFTP — secure file-based exchange, but it is not an API-style interface.

• BCP (Business Continuity Plan): Ensures the organization can continue its broader business operations during and after a disruption. It is broader than the IT-focused recovery required here.
• Communication plan: Defines how information is shared with employees, the public, and other stakeholders; it does not restore systems.
• IRP (Incident Response Plan): Handles and contains security incidents, such as malware or unauthorized access. A tornado is a disaster, not primarily a cybersecurity incident.

1. Modify the database subnet NACL inbound rules to allow traffic from the new web subnet’s CIDR block on the MySQL port (3306).
2. Modify the database subnet NACL outbound rules to allow return traffic to the new web subnet’s CIDR block on the required ephemeral port range.

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects scripts into web pages viewed by other users.
• Sideloading: Installing an application from outside the official app store. It may install unauthorized apps, but it does not generally unlock the operating system or enable restricted system features.

• Gaia Portal: Controlled by Gaia administration settings, not SmartConsole Trusted Clients.
• SSH: Controlled by Gaia or operating-system SSH access settings.
• Security Gateway(s): SmartConsole connects to the Security Management Server, not directly to gateways for this purpose.

• B. Users accessing Salesforce from public Wi-Fi

• C. Users choosing the same password as their Facebook password

• A: 2FA does not protect an already-authenticated, unlocked session if someone accesses an unattended laptop.
• D: Weak password-reset questions are an account-recovery weakness. 2FA primarily strengthens login authentication, not necessarily the security-question reset process.

• A vulnerability scanner automates discovery of known vulnerabilities and misconfigurations across systems. It can contribute to a supply-chain assessment.
• A penetration test actively attempts exploitation and is usually limited to an agreed scope.
• SCAP standardizes vulnerability and configuration assessment data; it is not the analysis itself.
• Illumination tool is not a commonly defined CompTIA Security+ term.

• B — Single customer login across properties: Customer 360 Identity provides centralized identity services, allowing an organization to recognize a customer across multiple digital properties and applications. This helps UC understand authenticated activity as part of a broader customer identity.

• C — Multi-brand support: Customer 360 Identity can support multiple brands and user experiences. Identity services can remain centralized while correlating a customer’s activity across different corporate brands or channels.

• A: Customer 360 Identity does not automatically populate all data into Customer 360 Data Manager and Customer 360 Audiences. Integration and data configuration are still required.
• D: Tracking anonymous activity and linking it after sign-up may be possible through broader customer-data and tracking implementations, but it is not the primary Customer 360 Identity benefit tested here. Identity focuses mainly on authentication, registration, and cross-property identity correlation.

• Whether a user has a console password
• Password age and last password change
• Whether MFA is enabled
• Access key status
• Access key creation date and last-use information
• Access key age, which helps audit rotation

• IAM Access Analyzer identifies unintended access to resources; it does not report credential age or rotation.
• AWS Artifact provides AWS compliance documents and agreements, not details about your IAM users.
• AWS Audit Manager helps collect evidence for audits, but it is not the direct tool for viewing IAM credential rotation details.

• A. IDS attack signatures: Primarily detects suspicious network activity, not necessarily malware embedded in uploaded files.
• C. Load balancer: Improves availability and distributes traffic; it does not inspect documents for malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not scanning uploaded PDFs for malware.

• T?o m?t Systems Manager Automation runbook d? ch?y l?nh kh?i d?ng l?i ?ng d?ng trên các EC2 instance.
• T?o m?t Amazon EventBridge rule ph?n ?ng khi CloudWatch alarm chuy?n sang tr?ng thái ALARM.
• Ð?t Automation runbook làm target c?a EventBridge rule.

1. Log c?a ?ng d?ng du?c ghi vào CloudWatch Logs.
2. CloudWatch alarm phát hi?n nhi?u l?i liên quan d?n vi?c restart.
3. Alarm chuy?n sang tr?ng thái ALARM.
4. EventBridge nh?n s? ki?n thay d?i tr?ng thái này.
5. EventBridge g?i Systems Manager Automation runbook.
6. Runbook restart ?ng d?ng trên các EC2 instance, không restart c? instance.

• A: SNS không tr?c ti?p g?i Systems Manager Automation runbook nhu m?t target native.
• B: Lambda có th? th?c hi?n vi?c restart, nhung ph?i t? x? lý vi?c xác d?nh instance và ch?y l?nh t? xa.
• C: Lambda ch? làm trung gian d? g?i runbook, không c?n thi?t vì EventBridge có th? g?i runbook tr?c ti?p.

• Customize Opportunity Contact Role

• Add the Opportunity Contact Role related list to the Opportunity page layout

• Campaign Member Role relates contacts or leads to campaigns, not opportunities.
• Campaign Member related list would expose campaign participation, not the stakeholders for the opportunity.
• Customize Campaign Role also concerns campaigns.

• Basic: No technical or architectural guidance.
• Standard: Technical support, but not the required design-assessment service.
• Professional Direct: Provides advisory and architecture guidance.
• Premier: Provides it too, but is unnecessarily expensive for this requirement.

• Business
• People
• Governance
• Platform
• Security
• Operations

• Cloud financial management
• Portfolio management
• Data governance
• Risk management
• Compliance

• Microservices: An application-design approach that divides an application into smaller services. It does not inherently reduce the number of operating systems.
• Virtualization: Creates virtual machines, but each VM generally requires its own complete operating system. This improves isolation but does not minimize OS instances as effectively.
• Infrastructure as code: Uses code to automate infrastructure deployment and configuration. It improves consistency but does not determine how many operating systems are used.

• Manage multiple organizations from one hierarchy.
• Enterprise-wide policies, including repository visibility, forking, and GitHub Copilot policies.
• Centralized identity and access management, such as SAML SSO, SCIM provisioning, and—where applicable—Enterprise Managed Users.
• Centralized billing and licensing, including organization and Copilot seat management.
• Enterprise audit log, which aggregates activity across organizations.
• Security and compliance oversight, such as organization security visibility and enterprise-wide controls.
• Enterprise support and account management features, depending on the plan.

• Organization: manages its own repositories, teams, members, and local policies.
• Enterprise: governs multiple organizations and can enforce policies across them.

json 
{ 
  "Effect": "Deny", 
  "NotAction": [ 
    "iam:*", 
    "route53:*", 
    "cloudfront:*", 
    "support:*" 
  ], 
  "Resource": "*", 
  "Condition": { 
    "StringNotEquals": { 
      "aws:RequestedRegion": "eu-west-1" 
    } 
  } 
}

• SCPs set maximum permissions; they do not grant permissions. The default SCP allows actions, so the restriction must be an explicit Deny.
• aws:RequestedRegion checks the Region targeted by an API request.
• StringNotEquals: eu-west-1 denies requests directed to every other Region.
• NotAction allows designated global services to remain usable because they do not operate in a single AWS Region.
• Attaching the SCP to the OU makes it apply to existing accounts and accounts later added to that OU.

• The application failing to start or becoming unhealthy
• An incorrect probe path, port, or protocol
• The application needing more startup time
• Dependency or configuration failures
• A liveness probe being too aggressive

bash 
kubectl describe pod <pod-name> 
kubectl logs <pod-name> --previous

• Scale to more replicas: may hide the issue but does not diagnose it.
• Decrease initialDelaySeconds: makes probes run earlier and could worsen startup failures.
• Drain and reboot the node: node metrics are normal, so rebooting is not justified as the first step.

• Compare each server’s drive specifications and performance data.
• Identify the drive that is faulty, slow, or mismatched.
• Replace it with a drive that matches the required interface, capacity, and performance characteristics.
• Avoid selecting a slower drive, because storage performance can bottleneck the entire server.
• In a redundant array, use a compatible replacement so rebuilding does not create unnecessary performance degradation.

• SAML: Enables federated authentication and single sign-on between the IdP and SaaS providers.
• OAuth tokens: Allow delegated application access; OAuth is not primarily the first step for employee SSO.
• Password vaulting: Stores or autofills multiple passwords but does not eliminate the separate credentials or provide true federation.

• Conserve public IPv4 addresses: IPv4 addresses are limited, so many internal devices share a smaller number of public addresses through NAT.
• Reduce direct exposure: Private addresses are not directly routable from the public Internet, which helps reduce unsolicited access to internal devices.

• ARP poisoning: Redirects or intercepts local network traffic; monitoring would typically show suspicious ARP changes or man-in-the-middle behavior.
• Jamming: Interferes with wireless or radio signals. It would affect connectivity, not usually show a server-specific overload.
• Kerberoasting: Attempts to obtain and crack Kerberos service-account hashes; it does not normally cause a system outage.