Roaming assessor laptops connect from hotels and home networks to municipal apps but lack host firewalls and modern endpoint detection. Which measure best addresses this network-component concern?
Select an answer to reveal the explanation.
Short Explanation
Once that laptop leaves city hall, the campus firewall isn’t babysitting it anymore. Host firewall plus solid endpoint detection is the seatbelt for roaming gear—especially on hotel Wi-Fi.
Full Explanation
Roaming assessor laptops leave the protection of the campus edge the moment they sit on hotel or home Wi-Fi. Host-based firewalls and centrally managed EDR-class controls keep local attack surface reduced and provide detection/response when those devices browse untrusted networks or bring malware back toward municipal apps. Without agents, VPN performance arguments do not compensate for blind endpoints that become pivots into city systems after compromise abroad. Endpoint controls are the seatbelt when the campus firewall is no longer in the path.
Removing all endpoint agents to improve VPN performance strips visibility and host policy exactly when roaming risk peaks. Depending only on a hotel captive portal for malware prevention mistakes an access gateway splash for security tooling. Allowing local admin rights without agents so assessors can install any tool abroad maximizes both productivity of malware and difficulty of remote remediation.
Exam caveat: CISSP endpoint and remote-access design expects host firewalls and modern detection on devices that leave trusted networks. Network portals and performance excuses do not replace managed endpoint security.
Operational check: enforce EDR and host firewall via MDM/UEM compliance gates before VPN or app access; deny local admin by default; validate agent health from hotel networks in tests; and alert on assessor devices that check in without current signatures or policies.