A healthcare firm's posture policy must treat a Windows laptop as compliant only when antivirus is installed, definitions are current, and real-time scanning is on. Endpoints failing any check should reach a remediation server to self-fix, while endpoints with no posture agent must stay on limited network access. Which posture requirement and action set should be configured?
Select an answer to reveal the explanation.
Short Explanation
Think of the antivirus checks as three locks: set the requirement to All, so your laptop passes only when antivirus is installed, definitions are current, and real-time scanning is on. If any check fails, redirect your endpoint to the remediation server; if it has no posture agent, give it limited access with a dACL. One passing check cannot make the whole laptop compliant.
Full Explanation
Posture separates the standard from the outcome. A requirement holds its conditions, and its combination setting determines whether any one match or every match counts. The antivirus requirement must include installed software, current definitions, and active real-time scanning, with All conditions required to pass. The correct action set redirects endpoints that fail a check to the remediation server and gives endpoints reporting no agent a limited dACL. Putting failures in a restricted VLAN does not meet the specified remediation-server redirect. Redirecting failed checks but quarantining agent-less endpoints also violates the requirement that those endpoints retain limited network access. Using Any would let a laptop pass when only one antivirus check succeeds, so it would not enforce the stated standard. As an exam caveat, distinguish a failed posture check from the absence of a posture agent: the policy assigns them different outcomes. As a practical check, test a compliant laptop, one failing each antivirus condition, and one without an agent, then verify the access action in live logs.