Managed laptops used by staff who administer cloud control planes need malware protection and full-disk encryption. Which control category addresses those device requirements?
Select an answer to reveal the explanation.
Short Explanation
The cloud console is only as safe as the laptop signing into it. Malware protection and disk encryption on those managed endpoints keep a stolen or infected device from becoming a free ticket to the control plane. Shared responsibility does not mean the city can ignore the laptop.
Full Explanation
Endpoint protection covers devices that access cloud environments—antimalware, disk encryption, and related hygiene—so compromised or lost staff laptops do not easily yield cloud admin sessions or residual data. Managed laptops used by staff who administer cloud control planes need those controls under the city’s shared-responsibility practices for endpoints.
Ignoring endpoint hygiene because cloud providers own all risk misunderstands shared responsibility for customer devices. Disabling disk encryption so lost-laptop forensics is "easy" increases breach impact from theft. Allowing unmanaged personal phones unrestricted owner roles in production subscriptions bypasses device trust requirements.
Exam caveat: endpoint controls complement MFA and conditional access; they do not replace IAM least privilege. MDM/EDR often enforce the technical baseline.
Operational check: enroll admin laptops in EDR and full-disk encryption, block portal access from noncompliant devices if conditional access exists, verify encryption keys escrowed, and remove local admin rights where feasible. Report compliance rates for privileged users monthly.
Privileged cloud operators should use city-managed endpoints only; document exceptions for break-glass from a sealed secure workstation so endpoint protection expectations remain enforceable for day-to-day admin work.