Forescout FSCP Exam - Topic 5 Question 2 Discussion

Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:

According to theForescout CounterACT HPS Inspection Engine Configuration Guide Version 10.8, when the Endpoint Remote Inspection method is set to 'Using MS-WMI,' scripts are runusing WMI, but they may not be run interactively using this method.

MS-WMI Script Execution:

According to the HPS Inspection Engine guide:

'When Remote Inspection uses MS-WMI, run scripts with

MS-WMI-- note that interactive scripts are not supported by WMI on all Windows endpoints. Functionality that relies on interactive endpoint scripts is not implemented when you choose this option. For example, the Start Antivirus and Update Antivirus actions require interactive scripts to manage some antivirus packages.'

Interactive Script Limitations with WMI:

According to the documentation:

'WMI does not support interactive scripts (such as scripts that support Guest Registration and other HTTP-based actions) on some Windows endpoints.'

How WMI Scripts Are Run:

According to the documentation:

When using WMI for script execution:

Background Scripts- Most background scripts can run via WMI

Interactive Scripts- NOT supported by WMI on all endpoints

Workaround for Interactive Scripts- CounterACT uses:

fsprocsvc service(fsprocsvc.exe) - For interactive script support

Microsoft Task Scheduler- Alternative for interactive scripts

WMI vs. Other Methods:

According to the documentation:

Method

Interactive Scripts

Limitations

MS-WMI

Not supported on all endpoints

Limited to background scripts

fsprocsvc

Supported

Service must be running

Task Scheduler

Not on Vista/7

Legacy OS limitations

Script Execution Flow with MS-WMI:

According to the documentation:

'CounterACT runs most background scripts using WMI. WMI does not support interactive scripts (such as scripts that support Guest Registration and other HTTP-based actions) on some Windows endpoints. CounterACT uses the fsprocsvc service or Microsoft Task Scheduler to run interactive scripts on these endpoints.'

Why Other Options Are Incorrect:

A . Using Task Scheduler but with limitations- Task Scheduler is an ALTERNATIVE to WMI, not what MS-WMI uses

B . Using WMI, which will allow interactive scripts- Incorrect; WMI does NOT allow interactive scripts

C . Using RRP, which will allow interactive scripts- RRP is Remote Registry Protocol, not the script execution method with MS-WMI

E . Using fsprocserv.exe, but scripts may not be run interactively- fsprocserv.exe (fsprocsvc) DOES support interactive scripts; it's used as an alternative to overcome WMI limitations

Referenced Documentation:

CounterACT Endpoint Module HPS Inspection Engine Configuration Guide v10.8 - Script Execution Services section

When Remote Inspection uses MS-WMI, run scripts with

About MS-WMI