Courts want ransomware-like behavior set to Terminate, while clerks' machines stay at Alert for a week. What should the administrator configure?

Courts want ransomware-like behavior set to Terminate while clerks' machines stay at Alert for a week. Clone the clerks' policy, raise prevention to Terminate, and assign the clone only to the court sensor group—Alert versus Terminate is a policy dial, not a citywide light switch. Raising prevention to Terminate on the single shared policy used by courts and clerks fails by concept because one shared policy cannot hold two different prevention levels. Setting Terminate in NSX-T Identity Firewall and leaving Carbon Black at Alert for both groups fails because Identity Firewall is network identity policy, not CBC Endpoint Standard prevention level. Turning prevention off citywide and relying on a weekly full scan for courts fails because weekly scanning is not Terminate prevention and citywide off abandons clerks and courts alike. Exam caveat: CBC prevention levels are per policy via sensor-group assignment—clone and scope; do not overload one policy or substitute NSX or weekly AV. Operational check: confirm court sensors show Terminate and clerk sensors show Alert, generate a test behavioral event in a lab court image if available, and keep the one-week clerk pilot timeline in the change record. Schedule the clerk promotion to Terminate after the pilot so courts and clerks do not permanently diverge without review.