Forescout FSCP Exam - Topic 10 Question 12 Discussion

Based on the policy condition image provided showing theNOT checkbox on 'Windows Antivirus Update Data', the correct statement is that theNOT operator negates the criteria inside the property.

Understanding the NOT Operator:

When theNOT checkbox is selectedon a policy condition property, it performs alogical negation (NOT operation) on the criteria evaluation. According to the Forescout Administration Guide:

The NOT operator creates an inverted evaluation:

Without NOT:'Windows Antivirus Update Data = [value]'

Result: Matches endpoints where the property equals the specified value

With NOT (as shown in the image):'NOT (Windows Antivirus Update Data = [value])'

Result: Matches endpoints where the property does NOT equal the specified value

How the NOT Operator Works:

The NOT operator negatesthe criteria inside the property:

Criteria Evaluation- The property condition is evaluated normally first

Negation Applied- The result is then inverted (TRUE becomes FALSE, FALSE becomes TRUE)

Final Result- The endpoint matches only if the negated condition is true

Example from the Image:

The image shows:

First criterion: 'Windows Antivirus Running - 360 Sat' (AND)

Second criterion: 'NOTWindows Antivirus Update Data' (checked)

This means:

The endpoint must have Windows Antivirus Running = True (360 Sat)

ANDthe endpoint must NOT have the Windows Antivirus Update Data property value (whatever was specified)

The NOT negates the criteriainsidethe property condition

NOT vs. 'Evaluate Irresolvable As':

According to the documentation, these areindependent settings:

Setting

Purpose

NOT Checkbox

Negates the criteria evaluation (inverts the match logic)

Evaluate Irresolvable As

Defines how to handle unresolvable properties (when data cannot be determined)

The NOT operator worksinsidethe property evaluation, while 'Evaluate Irresolvable As' is a separate setting that determines behavior when a property cannot be resolved.

Why Other Options Are Incorrect:

A . Irresolvable hosts would match the condition- The NOT operator doesn't specifically affect how irresolvable properties are handled

C . Negates the criteria outside the property- The NOT operator is internal to the property; it negates the criteria inside, not outside

D . Modifies the irresolvable condition to TRUE- The NOT operator doesn't modify the 'Evaluate Irresolvable As' setting; these are independent

E . Negates the 'evaluate irresolvable as' setting- The NOT operator and 'Evaluate Irresolvable As' are separate; NOT doesn't affect or negate that setting

Policy Condition Structure:

According to the Forescout Administration Guide:

A policy condition is structured as:

text

[NOT] [Property Name] [Operator] [Value]

Where:

[NOT]- Optional negation operator (what the checkbox controls)

[Property Name]- The property being evaluated

[Operator]- The comparison operator (equals, contains, greater than, etc.)

[Value]- The value to match against

When NOT is checked, it negates the entire criteria evaluationinsidethat property condition.

Referenced Documentation:

Forescout Administration Guide v8.3

Forescout Administration Guide v8.4

Define policy scope documentation

Forescout eyeSight policy sub-rule advanced options