Courts want ransomware-like behavior set to Terminate, while clerks…

Question

Courts want ransomware-like behavior set to Terminate, while clerks' machines stay at Alert for a week. What should the administrator configure?

Accepted Answer

Clone the clerks' policy, raise prevention to Terminate, and assign the clone only to the court sensor group — Alert versus Terminate is a policy dial, not a citywide light switch. Clone the clerks' policy, crank courts to Terminate, and hang that clone on the court sensor group.

Answer

Raise prevention to Terminate on the single shared policy used by courts and clerks

Answer

Set Terminate in NSX-T Identity Firewall and leave Carbon Black at Alert for both groups

Answer

Turn prevention off citywide and rely on a weekly full scan for courts

Courts want ransomware-like behavior set to Terminate, while clerks' machines stay at Alert for a week. What should the administrator configure?

Short Explanation

Full Explanation