A healthcare group requires laptops to run the corporate EDR agent and have disk encryption before touching patient systems. Machines that fail must land in a limited-access VLAN and get the missing agent installed automatically. Which posture policy design meets all four requirements?
Select an answer to reveal the explanation.
Short Explanation
You’ll check that the EDR service is running and disk encryption is enabled, then use authorization policy to send compliant laptops to normal access and failures to a limited VLAN. That VLAN works like a waiting room while an installer automatically adds the missing EDR agent.
Full Explanation
The design that checks both the EDR service and disk encryption, uses authorization policy to grant normal access only to machines that pass, places failures in the limited-access VLAN, and configures installer remediation meets all four requirements. The support-staff workflow checks both conditions and assigns the right access, but relies on staff to install the missing agent, so installation is not automatic. The remediation-ACL design checks both conditions and automates installation, but restricts failed machines with an ACL rather than placing them in the specified limited-access VLAN; restricted traffic is not the same as required network placement. The design that checks only the EDR service assigns access and automates installation, but omits disk encryption, so an unencrypted machine could be treated as compliant and receive normal access. Exam caveat: distinguish a control’s security effect from the required implementation mechanism—restricted access is not necessarily the same as VLAN assignment. Practical check: test representative endpoints that pass both checks, fail each check individually, and fail both; verify their assigned network segment, permitted reachability, and whether agent installation starts without user or support intervention.