Correct Answer: A, C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:
According to theForescout Administration Guide - Device Information Properties documentation, the correct statements about the comments field are:Endpoints may have multiple comments assigned to them (A) and it can be edited manually by a right click administrator action, or it can be edited in policy by using the action 'Run Script on CounterACT' (C).
Comments Field Overview:
According to the Device Information Properties documentation:
'(Right-click an endpoint in the Detections pane to add a comment. The comment is retained for the life of the endpoint in the Forescout Console.)'
Multiple Comments Support:
According to the ForeScout Administration Guide:
Endpoints supportmultiple commentsthat can be added over time:
Manual Comments- Administrators can right-click an endpoint and add comments
Policy-Generated Comments- Policies can automatically add comments when conditions are met
Cumulative- Multiple comments are retained and displayed together
Persistent- Comments are retained for the life of the endpoint
Manual Comments via Right-Click:
According to the documentation:
Administrators can manually edit the comments field by:
Right-clicking on an endpoint in the Detections pane
Selecting 'Add comment' or 'Edit comment' option
Entering the comment text
Saving the comment
This manual method is readily available and frequently used for operational notes.
Policy-Based Comments via 'Run Script on CounterACT':
According to the Administration Guide:
Policies can also edit the comments field using the'Run Script on CounterACT' action:
Create or edit a policy
Add the 'Run Script on CounterACT' action
The script can modify the Comments host property
When the policy condition is met, the script runs and updates the comment field
Why Other Options Are Incorrect:
B . Cannot be edited manually...only via Run Script on CounterACT- Incorrect; manual right-click editing is explicitly supported
D . Endpoints may have exactly one comment- Incorrect; multiple comments are supported
E . Can be edited...by using action 'Run Script on Windows'- Incorrect; the action is 'Run Script on CounterACT,' not 'Run Script on Windows'
Comments Field Characteristics:
According to the documentation:
The Comments field:
Supports Multiple Entries- More than one comment can be added
Manually Editable- Right-click administrative action available
Policy Editable- 'Run Script on CounterACT' action can modify it
Persistent- Retained for the life of the endpoint
Searchable- Comments can be used in policy conditions
Audit Trail- Provides documentation of endpoint history
Usage Examples:
According to the Administration Guide:
Manual Comments:
'Device moved to Building C - 2024-10-15'
'User reported software issue'
'Awaiting quarantine release approval'
Policy-Generated Comments:
Vulnerability compliance policy: 'Failed patch compliance check'
Security policy: 'Detected unauthorized application'
Remediation policy: 'Scheduled for antivirus update'
Multiple such comments can accumulate on a single endpoint over time.
Referenced Documentation:
Forescout Administration Guide - Device Information Properties
ForeScout CounterACT Administration Guide - Comments field section
