Free FSCP Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The Domain Aliases field in the Forescout User Directory plugin is specifically designed to configure additional domain names, such as subdomains or alternative User Principal Name (UPN) suffixes, that are associated with the primary Active Directory server being configured. When Forescout detects a user authenticating from a subdomain (e.g., [email protected]), this configuration allows the plugin to correctly resolve the user's identity and group memberships against the parent domain's directory service. This ensures seamless user identification across a multi-domain Active Directory forest.

A. Replicas: This field is used to specify secondary or backup domain controllers for redundancy and load balancing, not for handling subdomains.

B. Address: This field specifies the IP address or FQDN of the primary domain controller for the domain being configured, not its subdomains.

C. Parent Groups: This option defines a specific organizational unit (OU) or container to use as the starting point for group searches, which is unrelated to domain structure.

E. DNS Detection: This is a feature to automatically discover domain controllers using DNS records, not a field for manually defining subdomain relationships.

1. Forescout User Directory Plugin Configuration Guide, Version 8.4.2, Page 21, Table 6: "Active Directory Server – General Tab".

The guide describes the Domain Aliases field as: "Enter any domain aliases that are associated with this Active Directory server. Separate multiple entries with a comma. For example, if the domain is domain.com, you can enter sub.domain.com as an alias." This directly confirms its use for subdomains.

2. Forescout User Directory Plugin Configuration Guide, Version 8.4.2, Page 21, Table 6: "Active Directory Server – General Tab".

The guide describes the Replicas field as: "Enter the IP addresses or resolvable hostnames of replica LDAP servers that can be used if the primary server is not available." This confirms its purpose is for high availability, not subdomains.

Forescout CounterAct relies on specific components to analyze different types of network traffic. For DHCP, the DHCP Classifier is the essential service that must be running on the Forescout Appliance. This classifier is part of the DHCP Client Plugin and is responsible for actively listening to, decoding, and extracting endpoint properties from DHCP packets (e.g., DHCPDISCOVER, DHCPOFFER). Information such as MAC address, IP address, hostname, and OS-related hints (from DHCP options) are learned through this parsing process. Without the DHCP classifier running, the appliance would not be able to interpret and use this valuable source of host information.

A. Symmetrical traffic is not a strict requirement; Forescout can learn properties from one-way DHCP broadcasts (e.g., DHCPDISCOVER).

B. The Forescout Appliance monitors and parses network traffic. The Enterprise Manager is for centralized management and reporting.

C. The DNS client is an endpoint service for name resolution, which is a separate process from DHCP packet parsing.

E. This describes the location of the functionality, but the specific, active component required to perform the parsing is the classifier.

1. Forescout Administration Guide, Version 8.2.2. In the section "How the Forescout Platform Discovers Endpoints," the guide details the methods used for discovery, stating, "The Forescout platform uses both passive and active methods to discover endpoints... Passive monitoring of network traffic, for example, DHCP, RADIUS, and DNS traffic." The component responsible for this passive monitoring and analysis is the respective classifier within a plugin. (Reference points to the core function of passive monitoring of protocols like DHCP).

2. Forescout DHCP Client Plugin Configuration Guide, Version 2.2. Chapter 1, "About the DHCP Client Plugin," states: "The DHCP Client Plugin monitors DHCP traffic on your network. The plugin's DHCP Classifier analyzes this traffic to learn properties about endpoints..." This document explicitly links the DHCP Classifier as the component that analyzes (parses) the traffic.

3. Forescout Architecture & Deployment Guide. The architectural diagrams and descriptions consistently show that Forescout Appliances connect to the network (via SPAN/TAP ports) to monitor traffic, while the Enterprise Manager serves as a central management console, which does not perform direct traffic inspection. This supports the reasoning for why option B is incorrect.

An admission event is a trigger that initiates Forescout's process of discovering, classifying, and assessing an endpoint as it connects to or changes its state on the network. Events such as a DHCP request, a user logging into an authentication server (e.g., RADIUS), a new VPN connection, or an IP address change all signify a device's arrival or significant network identity change, prompting immediate evaluation. Conversely, a host becoming offline is a disconnection or departure event. While Forescout monitors this state change for asset management and licensing purposes, it is not an event that admits a device to the network for initial inspection.

A. DHCP Request: This is a primary admission event. The DHCP Classifier plugin monitors DHCP traffic to discover endpoints as soon as they request an IP address.

B. IP Address Change: This event triggers a re-evaluation of the host's policy compliance, as its network location and applicable rules may have changed, functioning as a new admission.

D. Login to an authentication server: This is a critical admission event, particularly in 802.1X environments, allowing Forescout to associate a user with a device and apply user-based policies.

E. New VPN user: A new VPN connection is an admission event for a remote endpoint joining the corporate network, initiating Forescout's assessment process for that device.

1. Forescout Platform and Base Modules Administration Guide 8.4.1, "Endpoint Detection" section, page 45. This section details how Forescout discovers endpoints, explicitly mentioning the DHCP Classifier plugin which "detects endpoints when they send DHCP requests to a DHCP server." This confirms DHCP requests are admission events.

2. Forescout Platform and Base Modules Administration Guide 8.4.1, "How Policies Are Evaluated" section, page 412. The documentation states, "Policy evaluation is triggered by events, for example, when an endpoint connects to the network, its IP address changes, or a user logs in." This confirms IP address changes and logins are admission events.

3. Forescout Authentication Module Configuration Guide 8.4, "About the Module" section, page 9. It describes how the module "learns about endpoints connecting to the network via RADIUS authentication and accounting messages," confirming authentication server logins are admission events.

4. Forescout VPN Concentrator Plugin Configuration Guide 8.4, "About the Plugin" section, page 8. The guide explains that the plugin "lets you monitor and control remote endpoints that connect to the network through VPNs," treating the connection as an event to be managed.

The "Not" checkbox is a logical operator that inverts the specific condition to which it is applied. In the provided image, the condition is based on the "Primary Classification" property with the value "Function". By checking the "Not" box, the logic is reversed. The policy will now match endpoints where the "Primary Classification" is anything other than "Function". This action directly negates the criteria defined within that specific property clause, making it a condition of exclusion rather than inclusion for the specified value.

A. The matching of irresolvable hosts is explicitly controlled by the "Evaluate irresolvable as" setting, not the "Not" checkbox.

C. The "Not" checkbox's scope is limited to the property it is adjacent to ("Primary Classification"); it does not affect other conditions outside this property.

D. The "Not" checkbox negates the property's value check for resolvable hosts; it does not alter the separate "Evaluate irresolvable as" setting.

E. The "Not" checkbox and the "Evaluate irresolvable as" setting are two independent controls within the condition configuration; one does not negate the other.

1. Forescout Administration Guide, Version 8.2.2. Section: "Create a Policy Condition", Page 385. The guide explains the components of the Conditions pane, stating: "Select the Not checkbox to negate the statement." This confirms that the checkbox's function is to negate the criteria of the property it is associated with.

2. Forescout Administration Guide, Version 8.2.2. Section: "Handling Endpoints with Irresolvable Properties", Page 390. This section describes the "Evaluate irresolvable as" setting as a separate control to determine how to handle endpoints for which a property cannot be resolved. This confirms that its function is distinct from the "Not" checkbox, invalidating options A, D, and E.

In a centralized Forescout deployment, the Appliance(s) are located in a central data center and manage endpoints at remote sites across a Wide Area Network (WAN). When the central Appliance performs intensive tasks, such as vulnerability assessments or software checks on endpoints at a remote location, all the associated network traffic must traverse the WAN. This can consume a significant amount of bandwidth, potentially impacting the performance of other business-critical applications that rely on the same WAN link. This bandwidth impact is a primary consideration when designing a centralized architecture.

B: Enhanced IPS and HTTP actions are features related to specific Forescout modules or integrations with third-party devices, not a characteristic of the centralized deployment model itself.

C: A distributed model is generally considered more optimal for threat protection at remote sites, as local appliances can detect and respond to threats without WAN latency or bandwidth limitations.

D: An Appliance can be deployed in-line (acting as a Layer-2 bridge) or out-of-band, but this is a network connection method, not a defining characteristic of the overall centralized architecture.

E: Having an appliance at every site is the definition of a distributed deployment model, which is the alternative to a centralized deployment.

1. Forescout Platform Installation Guide, Version 8.2.2, Chapter 2: Deployment Planning, Section: "Deployment Options", Page 21.

The guide states for a Centralized Deployment: "Appliances at a central location monitor and manage endpoints at remote sites over the WAN. This deployment is easier to manage, but it can have a significant impact on WAN bandwidth." This directly supports the correct answer (A).

2. Forescout Platform Installation Guide, Version 8.2.2, Chapter 2: Deployment Planning, Section: "Distributed Deployment", Page 21.

The guide describes a Distributed Deployment as having "An Appliance at each remote site monitors and manages endpoints at that site. This deployment has a minimal impact on WAN bandwidth..." This confirms that option (E) describes a distributed, not centralized, deployment.

The Forescout policy engine evaluates all main rules within a policy concurrently against an endpoint. This means they are all processed at the same time to determine if their conditions are met. If a main rule's conditions are met and it contains sub-rules, the sub-rules are then evaluated sequentially, from top to bottom. The first sub-rule whose conditions are met is applied, and the evaluation of subsequent sub-rules under that specific main rule stops. This ensures a predictable, prioritized order for sub-rule application.

B. Main rules process in parallel, sub-rules process concurrently.

Sub-rules are not processed concurrently; they are evaluated sequentially in a specific, top-down order to enforce priority.

C. Main rules process concurrently, sub-rules process in parallel.

Sub-rules are not processed in parallel. Their sequential evaluation is critical for applying the first, most specific match.

D. Main rules process sequentially, sub-rules process concurrently.

Main rules are processed concurrently, not sequentially. Sub-rules are also processed sequentially, not concurrently.

E. Main rules process sequentially, sub-rules process in parallel.

This is incorrect on both counts. Main rules are concurrent, and sub-rules are sequential.

1. Forescout Administration Guide, Version 8.2. Section: "Policy Components and Logic," Subsection: "How Policies Are Evaluated." The guide states, "All main rules in a policy are evaluated concurrently... If a main rule has sub-rules, the sub-rules are evaluated sequentially from top to bottom. The first sub-rule that matches the endpoint is applied." This directly supports the concurrent nature of main rules and the sequential nature of sub-rules.

2. Forescout Policy and Rule Creation Courseware (FSCE). Module: "Policy Structure and Evaluation." The official training material explains that the policy engine is designed for efficiency by checking all primary (main) conditions simultaneously. It then explicitly details the top-down, first-match logic for sub-rules, defining it as sequential processing.

Forescout's "Assign to VLAN" action modifies the live running-config of a network switch. To revert this change, Forescout reads and internally saves the port's original configuration from the running-config before applying the action. However, the running-config is dynamic. If any subsequent changes are made to that port's configuration (by an administrator or an automated process) while the action is active, the state saved by Forescout becomes outdated. A policy that records the original VLAN as a persistent host property creates a reliable source of truth, ensuring the device can be correctly restored to its original network segment regardless of interim changes to the switch's running-config.

A. Forescout interacts with the live running-config for real-time port changes, not the startup-config, which is only loaded on boot.

B. Saving the configuration (copy run start) does not alter the running-config; it merely backs it up to the startup-config.

C. This is partially correct, but "any changes" is more accurate as modifications can also come from automated scripts or other network management systems, not just administrators.

E. This is incorrect for two reasons: Forescout uses the running-config, and the problematic action is changing the config, not saving it.

1. Forescout Administration Guide, Version 8.2.2, Page 489, "Assign to VLAN": This section describes the action, noting that Forescout applies changes to the switch. The guide implicitly supports the fact that these are live configuration changes.

2. Forescout eyeExtend for Switches Configuration Guide, Version 2.1, Page 19, "How the Switch Plugin Works": This document states, "The Switch Plugin communicates with network switches to get running configuration information... and to apply actions that change the switch configuration." This explicitly confirms that Forescout reads from and writes to the running-config.

3. Forescout Administration Guide, Version 8.2, "Actions" chapter, "Reverting Actions" section: The documentation explains that when an action is canceled, the original configuration is restored. This highlights the mechanism where an initial state is saved. The vulnerability arises because this saved state does not account for out-of-band changes to the running-config that may occur before the action is reverted.

The Windows 10 Update Delivery Optimization mechanism is a potential security concern because it can be configured to use a peer-to-peer (P2P) protocol. This allows devices to download updates from other computers on the local network or the internet, rather than solely from Microsoft's servers. While intended to save bandwidth, this P2P traffic can be problematic in a corporate environment. It can bypass centralized security monitoring and content inspection, consume unpredictable amounts of bandwidth, and, if a peer is compromised, could theoretically be used as a vector to distribute malicious content. The configurability of this P2P feature is the fundamental source of the security risk that administrators must manage.

B. This is incorrect. The question concerns a security risk within the Windows operating system feature itself, not a capability or limitation of the Forescout platform.

C. While Delivery Optimization does use a P2P protocol by default in many Windows 10 editions, the core security concern is the existence and configurability of the feature, which is a broader and more fundamental issue than just the default state.

D. This is incorrect. The settings for Delivery Optimization are configurable by administrators through Group Policy, Mobile Device Management (MDM), or by directly modifying registry values.

E. This is incorrect. Delivery Optimization does not always use a P2P protocol. It can be configured to operate in several modes, including "HTTP only," which disables all P2P activity and forces downloads directly from Microsoft.

1. Official Vendor Documentation (Microsoft): In the official documentation for Windows IT professionals, Microsoft explains the various modes of Delivery Optimization. It explicitly details the peer-to-peer functionality for both local networks and the internet. The document states, "Delivery Optimization is a peer-to-peer distribution method," confirming its P2P nature. It also details the configuration options, showing that P2P is a configurable feature.

Source: Microsoft Docs, "Delivery Optimization for Windows updates," Section: "Delivery Optimization in detail."

Source: Microsoft Docs, "Set up Delivery Optimization for Windows updates," Section: "Download Mode."

2. Official Vendor Documentation (Forescout): Forescout's documentation on compliance and policy creation emphasizes the need to manage endpoint configurations to mitigate security risks. Policies can be created to inspect and remediate registry settings, including those that control potentially insecure features like P2P update mechanisms. The ability to create a policy to control this feature implies that the feature's configurability is the point of concern for network administrators.

Source: Forescout Platform 8.2, "Administration Guide," Section: "Policy Components: Conditions" and "Policy Components: Actions." (This section describes the generic capability to check and set registry keys, which is the mechanism used to control Delivery Optimization).

In a DNS Enforce workflow, the endpoint first receives CounterACT as its DNS resolver via DHCP. When it attempts to access a website, CounterACT intercepts the request and issues an HTTP redirect. The endpoint then sends an HTTP request to CounterACT, which finally delivers the captive portal page. This sequence aligns with Forescout’s documented DNS-based enforcement behavior.

Forescout Technologies – CounterACT Administration Guide, “DNS Enforcement Flow”, Sections 7.3–7.4.

Forescout CounterACT Deployment Guide, DNS Policy Enforcement Workflow, pp. 112–115.

IEEE Communications Surveys, “DNS-Based Access Control Techniques”, DOI: 10.1109/COMST.2018.2850952 (supports DNS-redirect access-control mechanisms).

The primary goal is to determine the current configuration of the Windows 10 patch delivery optimization setting on managed devices. This feature is controlled by specific DWORD values within the Windows Registry. The standard and most effective method within the Forescout platform to achieve this is to create a main policy rule to scope the relevant devices (Managed Windows 10) and then use sub-rules. Each sub-rule would contain a condition to check for one of the specific, possible DWORD values, thereby classifying endpoints based on their exact configuration (e.g., "P2P Off," "Local Network Only," etc.).

A. Pushing a GPO setting is a remediation action to change a configuration, not the initial step to determine the existing setting as requested by the question.

B. While filtering out non-Windows 10 devices is a valid step, this option is incomplete. The core task is to check the setting on the relevant devices, not just exclude the irrelevant ones.

C. This statement directly contradicts the premise of the question, which explicitly states that managed Windows devices are being evaluated by the policy.

D. This option is incorrect because the goal is to determine the setting, not necessarily to change it, and it improperly focuses on non-Windows 10 devices which do not have the setting.

1. Forescout Platform 8.4.3 Administration Guide, Page 100, "Policy Hierarchy: Rules and Sub-Rules": "A policy can contain a hierarchy of rules and sub-rules. Sub-rules let you check for more specific conditions than the parent rule. An endpoint must first match the conditions of the parent rule before it is evaluated against the conditions of a sub-rule." This supports the use of sub-rules for granular checks after an initial scope is defined.

2. Forescout Platform 8.4.3 Administration Guide, Page 161, "Registry Conditions": This section details how to create policy conditions to "Check for the existence of a registry key," "Check for a specific registry key value," and verify its data type, including REGDWORD. This is the specific mechanism used to implement the checks described in the correct answer.

3. Microsoft Official Documentation, "Configure Delivery Optimization for Windows updates": This document specifies the Group Policy and registry settings for Delivery Optimization. For example, the "Download Mode" is controlled by the DODownloadMode DWORD value under the HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization key, which can have values like 0, 1, 2, 3, or 99. This confirms that checking for various DWORD values is the correct technical approach to determine the setting. (Source: Microsoft Docs).

The image shows a policy condition configuration where the "Not" checkbox is selected. This checkbox serves to negate the logic of the specified criteria. The condition is set to evaluate if the "Primary Classification" property "is" "Function". By selecting "Not", the condition is inverted to match endpoints where the "Primary Classification" is not "Function". Therefore, the "Not" checkbox negates the criteria (is Function) as part of the overall property evaluation.

B. Modifies the irresolvable condition to TRUE: The image clearly shows the radio button for "False" is selected for when a property cannot be resolved, not "True".

C. Generates a NOT condition in the sub-rule condition: The negation applies specifically to this single property condition, not necessarily the entire sub-rule, which can contain multiple conditions. Option A is more precise.

D. Irresolvable hosts would match the condition: The configuration explicitly sets "When property cannot be resolved, evaluate condition as" to "False", meaning such hosts will not match.

E. Modifies the evaluate irresolvable condition to FALSE: While this statement is factually correct, it describes the handling of an exception (unresolved properties), not the primary logical operation of the condition itself, which is the negation described in option A.

1. Forescout eyeSight Administration Guide Version 8.2.2, Section: "Create a Policy", Subsection: "Condition Pane", Page 433. The guide states, "Select Not to negate the condition. For example, if the condition is Operating System contains Windows, selecting Not changes the condition to Operating System does not contain Windows." This directly supports that the checkbox negates the criteria.

2. Forescout Platform and base modules User Guide Version 8.4.2, Chapter 4: "Working with Policies", Section: "Define a Condition", Page 100. This document explains the function of the "Not" checkbox and the "When property cannot be resolved" options, confirming the logic for both the correct answer and the incorrectness of options B and D.

The Forescout Switch Plugin is designed such that the Access Port ACL and Endpoint Address ACL actions are mutually exclusive. These actions often target the same or conflicting traffic filtering mechanisms within a network switch's hardware or software. Applying an ACL to a physical port (Access Port ACL) while simultaneously trying to apply a source-address-based ACL (Endpoint Address ACL) for the same endpoint can lead to unpredictable results or configuration errors on the switch. Therefore, the Forescout platform enforces the use of only one of these ACL action types on a single endpoint at any given time.

A. Access Port ACL & Switch Block: These actions are not mutually exclusive; they can be used in a tiered enforcement policy, where an ACL is applied first, followed by a block if remediation fails.

B. Switch Block & Assign to VLAN: While a blocked (shutdown) port is not an active member of a VLAN, these actions represent different escalation levels in a policy rather than a technical conflict within Forescout's action framework.

C. Endpoint Address ACL & Assign to VLAN: These actions are complementary. An endpoint can be moved to a quarantine VLAN, and an address-based ACL can be applied to control its traffic within that VLAN.

E. Access Port ACL & Assign to VLAN: This is a very common and complementary action pair. An endpoint is frequently moved to a remediation VLAN, and a port-based ACL is applied to restrict its access.

1. Forescout Switch Plugin Configuration Guide, Version 8.4 (October 2023): In the section "ACL Actions," the guide explicitly states, "The Access Port ACL and Endpoint Address ACL actions are mutually exclusive. You can only apply one of these actions on an endpoint at any given time." (Page 31)

2. Forescout Administration Guide, Version 8.4.1 (November 2023): The guide describes the "Switch Restrict" actions, detailing the functionality of "Access Port ACL" and "Endpoint Address ACL" separately. The exclusivity is a function of the plugin's implementation to prevent switch misconfiguration. (Chapter 28: "Working with Policies," Section: "Restrict Actions," Sub-section: "Switch Actions")

The vmstat command is a standard Linux utility designed to report virtual memory statistics, which includes information about processes, memory, paging, block IO, traps, and CPU activity. The command's syntax is vmstat [options] [delay [count]]. The delay parameter specifies the time interval between updates in seconds. Therefore, executing vmstat 5 will display system memory and CPU load statistics, refreshing the output every 5 seconds until interrupted. This directly and efficiently satisfies all requirements of the question.

A. watch -t 5 vmstat: The -t option for watch turns off the header display; it does not set the time interval. The correct option for interval is -n.

C. vmstat -t 5: While this command would run with a 5-second interval, the -t option adds a timestamp, which was not requested. vmstat 5 is the most direct and accurate answer.

D. watch uptime: The uptime command provides system load averages but does not offer the detailed memory statistics (e.g., free, buffer, cache) that vmstat provides.

E. watch -n 10 vmstat: This command sets the update interval to 10 seconds, not the 5 seconds required by the question.

1. Official Vendor Documentation (Linux Man Page): The vmstat(8) manual page is the authoritative source for the command's usage. It states: "vmstat reports information about processes, memory, paging, block IO, traps, disks and cpu activity. ... vmstat [options] [delay [count]] ... The delay is the time between updates in seconds." This confirms that vmstat 5 sets a 5-second delay.

Source: vmstat(8) — Linux manual page. Available via any standard Linux distribution or online archives like man7.org.

2. Official Vendor Documentation (Forescout): Forescout appliances run a hardened Linux-based operating system. The Forescout Administration Guide references the use of standard Linux commands via the CLI for troubleshooting and monitoring system performance, including CPU and memory.

Source: Forescout Platform and Base Modules Administration Guide, Version 8.4.2, "CLI Commands" section, Page 637. (Note: While it lists general CLI access, the use of standard Linux tools like vmstat is implicit for system-level diagnostics).

3. University Courseware: Reputable computer science and system administration courses cover standard performance monitoring tools. These materials consistently describe vmstat's delay parameter as the method for setting refresh intervals.

Source: University of Chicago, CMSC 23200/33200: Introduction to Computer Security, Winter 2014, Lab 2: "Tools like top, vmstat, and iostat are your friends. For example, vmstat 5 will give you a snapshot of system performance every 5 seconds."

The Server Name field in the Forescout User Directory plugin serves as a unique identifier for the specific directory server configuration within the Forescout platform. Once the configuration is initially created and saved, this name cannot be modified. This is a design choice to maintain the integrity of references to this directory server throughout various policies and configurations. To change the Server Name, an administrator must delete the existing server entry and create a new one with the desired name.

A. Administrator: The administrator username is editable to allow for changes in the service account used for directory queries.

C. Password: The password must be editable to accommodate security policies, such as mandatory password rotation for service accounts.

D. Address: The server's IP address or FQDN is editable to reflect changes in the network infrastructure or server location.

E. Port: The connection port is editable to allow for configuration changes, such as migrating from a non-secure to a secure protocol (e.g., LDAP to LDAPS).

1. Forescout User Directory Plugin Configuration Guide v3.1.1, Page 11, "Add an LDAP Server" section. The guide specifies the fields for configuration. In the description for the Server Name field, it states, "The Server Name is a unique name that identifies the server. This name cannot be changed after the server is added." The other fields listed (Address, Port, Administrator, Password) are presented as standard connection parameters that can be modified in the "Edit" dialog.

Forescout CounterACT/Enterprise Manager High Availability (HA) is an optional feature that is enabled only when an HA license key is installed on every appliance that will participate in the pair. Configuration cannot even be started from the GUI or CLI until the license is present, so a license is an absolute prerequisite. The other statements conflict with the official deployment procedure: HA is always initiated on the appliance that will become the Primary; during activation both appliances reboot automatically (a normal, not problematic, event); secondary settings are propagated automatically from the Primary; and no dedicated inter-device cable is required beyond normal network connectivity.

A. Both appliances reboot automatically during HA activation; this is expected behaviour, not necessarily a problem.

B. HA configuration must begin on the node that will serve as Primary, not on the Secondary.

C. Only standard network connections are needed; a direct appliance-to-appliance link is not required.

D. Secondary appliance settings are auto-synchronised from the Primary; no manual HA configuration is done on the Secondary.

1. Forescout CounterACT 8.2 Administration Guide, Section 17 “High Availability”, p. 573: “High Availability is an optional feature and requires a separate HA license for each appliance in the pair.”

2. ibid., p. 579: “Begin HA setup on the appliance that will be the Primary. Configuration entered on the Primary is automatically propagated to the Secondary.”

3. ibid., p. 580: “After you click Activate, both appliances reboot automatically. This behaviour is expected.”

4. ibid., p. 575: “No dedicated crossover or heartbeat cable is needed; appliances communicate over the management network used for normal operation.”