City Finance laptops need stricter Carbon Black Cloud prevention than Parks laptops. Which configuration applies the right control to each population?
Select an answer to reveal the explanation.
Short Explanation
Finance and Parks are not the same neighborhood. Two sensor groups, two policies—and skip the one-size-fits-all Standard blanket.
Full Explanation
City Finance laptops need stricter Carbon Black Cloud prevention than Parks laptops. Create two sensor groups mapped to two distinct policies instead of one Standard policy for every endpoint—Finance and Parks are not the same neighborhood. Assigning a single Standard policy to the entire city fails by concept because one policy cannot express different prevention strength for two populations. Disabling prevention on Parks and leaving Finance on an NSX-T Distributed Firewall section fails because DFW is network micro-segmentation, not Endpoint Standard prevention on the laptop, and disabling Parks prevention abandons host control. Putting both departments in one sensor group and relying on weekly AV scans for Finance fails because weekly AV is not a substitute for continuous CBC prevention policy differentiation. Exam caveat: CBC prevention strength is per policy via sensor-group assignment—not one citywide Standard, not NSX DFW as EDR, not weekly AV. Operational check: verify Finance sensors show the strict policy and Parks sensors show the looser one, confirm neither group shares a single Standard assignment, and spot-check that prevention actions match each policy. Document group criteria (OU or metadata) in the civic EDR baseline so transfers between departments pick up the right policy automatically.