A security team discovers employees are using personal USB drives to transfer files to and from corporate laptops in violation of policy. Which endpoint control BEST technically enforces the USB restriction?
Select an answer to reveal the explanation.
Short Explanation
You need a technical control, so configure Device Control policies via EDR or Group Policy to block or restrict USB storage devices and log connection attempts. That stops unauthorized removable media at the operating system level, no matter what the user tries.
Full Explanation
The correct choice is the Device Control policy option because it technically enforces the USB restriction at the operating system level, blocking or restricting unauthorized removable media regardless of user intent or awareness, while logging connection attempts provides visibility. The intranet policy reminder is wrong because reminders without technical enforcement do not prevent intentional or accidental violations. The annual acceptable-use-policy acknowledgment is wrong because it is a governance control, not a technical prevention. The laptop-data-encryption option is wrong because encrypting laptop data does not prevent data from being copied to an unencrypted USB drive.