The image shows a policy condition configuration where the "Not" checkbox is selected. This checkbox serves to negate the logic of the specified criteria. The condition is set to evaluate if the "Primary Classification" property "is" "Function". By selecting "Not", the condition is inverted to match endpoints where the "Primary Classification" is not "Function". Therefore, the "Not" checkbox negates the criteria (is Function) as part of the overall property evaluation.

B. Modifies the irresolvable condition to TRUE: The image clearly shows the radio button for "False" is selected for when a property cannot be resolved, not "True".

C. Generates a NOT condition in the sub-rule condition: The negation applies specifically to this single property condition, not necessarily the entire sub-rule, which can contain multiple conditions. Option A is more precise.

D. Irresolvable hosts would match the condition: The configuration explicitly sets "When property cannot be resolved, evaluate condition as" to "False", meaning such hosts will not match.

E. Modifies the evaluate irresolvable condition to FALSE: While this statement is factually correct, it describes the handling of an exception (unresolved properties), not the primary logical operation of the condition itself, which is the negation described in option A.

1. Forescout eyeSight Administration Guide Version 8.2.2, Section: "Create a Policy", Subsection: "Condition Pane", Page 433. The guide states, "Select Not to negate the condition. For example, if the condition is Operating System contains Windows, selecting Not changes the condition to Operating System does not contain Windows." This directly supports that the checkbox negates the criteria.

2. Forescout Platform and base modules User Guide Version 8.4.2, Chapter 4: "Working with Policies", Section: "Define a Condition", Page 100. This document explains the function of the "Not" checkbox and the "When property cannot be resolved" options, confirming the logic for both the correct answer and the incorrectness of options B and D.

The Forescout Switch Plugin is designed such that the Access Port ACL and Endpoint Address ACL actions are mutually exclusive. These actions often target the same or conflicting traffic filtering mechanisms within a network switch's hardware or software. Applying an ACL to a physical port (Access Port ACL) while simultaneously trying to apply a source-address-based ACL (Endpoint Address ACL) for the same endpoint can lead to unpredictable results or configuration errors on the switch. Therefore, the Forescout platform enforces the use of only one of these ACL action types on a single endpoint at any given time.

A. Access Port ACL & Switch Block: These actions are not mutually exclusive; they can be used in a tiered enforcement policy, where an ACL is applied first, followed by a block if remediation fails.

B. Switch Block & Assign to VLAN: While a blocked (shutdown) port is not an active member of a VLAN, these actions represent different escalation levels in a policy rather than a technical conflict within Forescout's action framework.

C. Endpoint Address ACL & Assign to VLAN: These actions are complementary. An endpoint can be moved to a quarantine VLAN, and an address-based ACL can be applied to control its traffic within that VLAN.

E. Access Port ACL & Assign to VLAN: This is a very common and complementary action pair. An endpoint is frequently moved to a remediation VLAN, and a port-based ACL is applied to restrict its access.

1. Forescout Switch Plugin Configuration Guide, Version 8.4 (October 2023): In the section "ACL Actions," the guide explicitly states, "The Access Port ACL and Endpoint Address ACL actions are mutually exclusive. You can only apply one of these actions on an endpoint at any given time." (Page 31)

2. Forescout Administration Guide, Version 8.4.1 (November 2023): The guide describes the "Switch Restrict" actions, detailing the functionality of "Access Port ACL" and "Endpoint Address ACL" separately. The exclusivity is a function of the plugin's implementation to prevent switch misconfiguration. (Chapter 28: "Working with Policies," Section: "Restrict Actions," Sub-section: "Switch Actions")

The vmstat command is a standard Linux utility designed to report virtual memory statistics, which includes information about processes, memory, paging, block IO, traps, and CPU activity. The command's syntax is vmstat [options] [delay [count]]. The delay parameter specifies the time interval between updates in seconds. Therefore, executing vmstat 5 will display system memory and CPU load statistics, refreshing the output every 5 seconds until interrupted. This directly and efficiently satisfies all requirements of the question.

A. watch -t 5 vmstat: The -t option for watch turns off the header display; it does not set the time interval. The correct option for interval is -n.

C. vmstat -t 5: While this command would run with a 5-second interval, the -t option adds a timestamp, which was not requested. vmstat 5 is the most direct and accurate answer.

D. watch uptime: The uptime command provides system load averages but does not offer the detailed memory statistics (e.g., free, buffer, cache) that vmstat provides.

E. watch -n 10 vmstat: This command sets the update interval to 10 seconds, not the 5 seconds required by the question.

1. Official Vendor Documentation (Linux Man Page): The vmstat(8) manual page is the authoritative source for the command's usage. It states: "vmstat reports information about processes, memory, paging, block IO, traps, disks and cpu activity. ... vmstat [options] [delay [count]] ... The delay is the time between updates in seconds." This confirms that vmstat 5 sets a 5-second delay.

Source: vmstat(8) — Linux manual page. Available via any standard Linux distribution or online archives like man7.org.

2. Official Vendor Documentation (Forescout): Forescout appliances run a hardened Linux-based operating system. The Forescout Administration Guide references the use of standard Linux commands via the CLI for troubleshooting and monitoring system performance, including CPU and memory.

Source: Forescout Platform and Base Modules Administration Guide, Version 8.4.2, "CLI Commands" section, Page 637. (Note: While it lists general CLI access, the use of standard Linux tools like vmstat is implicit for system-level diagnostics).

3. University Courseware: Reputable computer science and system administration courses cover standard performance monitoring tools. These materials consistently describe vmstat's delay parameter as the method for setting refresh intervals.

Source: University of Chicago, CMSC 23200/33200: Introduction to Computer Security, Winter 2014, Lab 2: "Tools like top, vmstat, and iostat are your friends. For example, vmstat 5 will give you a snapshot of system performance every 5 seconds."

The Server Name field in the Forescout User Directory plugin serves as a unique identifier for the specific directory server configuration within the Forescout platform. Once the configuration is initially created and saved, this name cannot be modified. This is a design choice to maintain the integrity of references to this directory server throughout various policies and configurations. To change the Server Name, an administrator must delete the existing server entry and create a new one with the desired name.

A. Administrator: The administrator username is editable to allow for changes in the service account used for directory queries.

C. Password: The password must be editable to accommodate security policies, such as mandatory password rotation for service accounts.

D. Address: The server's IP address or FQDN is editable to reflect changes in the network infrastructure or server location.

E. Port: The connection port is editable to allow for configuration changes, such as migrating from a non-secure to a secure protocol (e.g., LDAP to LDAPS).

1. Forescout User Directory Plugin Configuration Guide v3.1.1, Page 11, "Add an LDAP Server" section. The guide specifies the fields for configuration. In the description for the Server Name field, it states, "The Server Name is a unique name that identifies the server. This name cannot be changed after the server is added." The other fields listed (Address, Port, Administrator, Password) are presented as standard connection parameters that can be modified in the "Edit" dialog.

Forescout CounterACT/Enterprise Manager High Availability (HA) is an optional feature that is enabled only when an HA license key is installed on every appliance that will participate in the pair. Configuration cannot even be started from the GUI or CLI until the license is present, so a license is an absolute prerequisite. The other statements conflict with the official deployment procedure: HA is always initiated on the appliance that will become the Primary; during activation both appliances reboot automatically (a normal, not problematic, event); secondary settings are propagated automatically from the Primary; and no dedicated inter-device cable is required beyond normal network connectivity.

A. Both appliances reboot automatically during HA activation; this is expected behaviour, not necessarily a problem.

B. HA configuration must begin on the node that will serve as Primary, not on the Secondary.

C. Only standard network connections are needed; a direct appliance-to-appliance link is not required.

D. Secondary appliance settings are auto-synchronised from the Primary; no manual HA configuration is done on the Secondary.

1. Forescout CounterACT 8.2 Administration Guide, Section 17 “High Availability”, p. 573: “High Availability is an optional feature and requires a separate HA license for each appliance in the pair.”

2. ibid., p. 579: “Begin HA setup on the appliance that will be the Primary. Configuration entered on the Primary is automatically propagated to the Secondary.”

3. ibid., p. 580: “After you click Activate, both appliances reboot automatically. This behaviour is expected.”

4. ibid., p. 575: “No dedicated crossover or heartbeat cable is needed; appliances communicate over the management network used for normal operation.”