A logistics firm opens its corporate WLAN to managed laptops only after a posture check passes. Laptops with disk encryption and the endpoint agent must reach full access, laptops failing a check must land in a remediation quarantine right away, and laptops whose agent stays silent must receive limited access as an unresolved case. Which posture result mapping should the policy enforce?

The required mapping distinguishes three outcomes: a passing posture check earns full access, a failed check triggers immediate quarantine, and a silent agent remains unknown and receives limited access while its status is unresolved. This preserves access for verified managed laptops while containing known failures without treating missing evidence as proof of failure. A fail-closed policy that places silent agents in quarantine is a common security choice, but it fails here because the scenario explicitly assigns silent agents limited access as unresolved cases. Deferring quarantine until a scheduled evaluation can be a reasonable design when a policy allows a grace period, but it fails the requirement to quarantine a failed check right away. Requiring individual administrator approval before granting full access can support additional governance, yet it fails the stated treatment of compliant laptops, which must receive full access after passing posture. An exam caveat is that “unknown” is not synonymous with “non-compliant”: policies may handle it differently, so follow the explicit access mapping in the question rather than assuming a universal default. In practice, verify the policy’s result-to-role rules and test pass, fail, and no-response cases, including whether quarantine is applied immediately and whether unknown endpoints retain only the intended limited permissions.