Courts require that Windows devices missing a critical security patch lose SSO to case-management apps. How should the administrator enforce that?
Select an answer to reveal the explanation.
Short Explanation
Missed patches should lock the courtroom app door, not flatten the whole court VLAN. Feed patch status into UEM compliance and let Access deny the case apps.
Full Explanation
When courts require that Windows devices missing a critical security patch lose SSO to case-management apps, the administrator should mark missing-patch devices non-compliant in Workspace ONE UEM and deny those devices in the Workspace ONE Access policy for case apps. Treat patch compliance as the courthouse badge: no current KB, no SSO to case files. Creating an NSX-T Distributed Firewall deny for all court VLANs until every laptop is patched fails by concept because VLAN-wide DFW deny is coarse network punishment, not device-scoped Access denial for missing patches. Uninstalling Carbon Black Cloud sensors from non-patched devices so they fail a network check fails because removing sensors weakens endpoint defense and is not the Access compliance path. Shortening the SAML certificate lifetime so unpatched devices cannot authenticate fails because certificate lifetime is federation crypto hygiene, not patch-compliance enforcement. Exam caveat: enforce missing-patch consequence via UEM non-compliance plus Access deny for case apps. Operational check: map critical KB to UEM compliance, confirm Access denies non-compliant devices to case apps, remediate patches, and document the compliance-to-Access chain in the courts security standard.