Remote staff authenticate with MFA, yet unmanaged personal laptops freely reach the tax-system VPN. What gap should the access design close?
Select an answer to reveal the explanation.
Short Explanation
Knowing it is Alice is not the same as knowing it is Alice's city-managed laptop. Add device auth or posture—certs, MDM compliance—so random home PCs do not waltz into the tax VPN.
Full Explanation
Access design for sensitive tax systems should authenticate the user and establish trust in the device or its posture. Requiring device authentication (certificates, hardware-backed keys) or compliance/posture checks (MDM, EDR health, disk encryption, patch level) prevents unmanaged personal laptops from satisfying policy with user MFA alone. Zero-trust-aligned municipal VPN or ZTNA brokers evaluate device signals before admitting endpoints to tax workloads.
Replacing MFA with longer passwords only weakens human authentication and still ignores device trust. Trusting any device after a CAPTCHA proves little about malware, patch state, or municipal ownership. Publishing VPN credentials on the intranet homepage maximizes credential exposure and invites uncontrolled clients. None of those distractors close the unmanaged-endpoint gap.
Exam caveat: MFA answers “something the user has/is”; device posture answers “is this endpoint acceptable”—stems that stress BYOD into sensitive networks want both. Operational check: enroll managed devices with certificates, block or quarantine noncompliant posture at the VPN/ZTNA broker, provide a managed VDI or BYOD browser isolation path for staff who lack city laptops, and log device identity alongside user identity for tax-system access reviews.