A user with a valid username, password, and MFA approval is denied access to the company's internal applications. The access logs show that the zero trust policy engine rejected the request because the user's laptop is missing critical operating system patches and its endpoint protection agent is not reporting. Which zero trust control caused the denial?

Zero trust architectures evaluate the device as well as the user. Device management controls maintain an inventory of known devices and assess each one's health posture at the time of access, checking signals such as patch level, operating system version, encryption status, and whether endpoint protection is running and reporting. A device that fails these checks can be denied or limited even when the user has authenticated successfully, because a compromised or vulnerable endpoint can undermine any credential used on it. A user authentication failure would occur if the password or MFA step failed, but the scenario states both succeeded and the logs cite the laptop's condition. An application allow-list block controls which applications may run on an endpoint, or which applications a user may reach, and it is not triggered by missing patches or a silent endpoint agent. A geolocation access restriction denies requests from disallowed locations, and the stated reason for denial concerns the device's state rather than where the user is. Exam caveat: posture checks depend on accurate telemetry, so an agent that is not reporting is itself treated as a failure rather than assumed healthy. Operational check: remediate the laptop by applying the missing patches and restoring the endpoint agent, confirm the device reports compliant to the policy engine, and review how many other devices are failing posture.