The city must put Carbon Black Cloud prevention on Windows staff laptops already managed by Workspace ONE UEM. What is the correct sensor path?
Select an answer to reveal the explanation.
Short Explanation
Physical laptops need the real CB Defense agent, same as putting a smoke detector in the office instead of wiring the building’s sprinkler panel to the notebook. UEM software distribution is the civic way to push that signed MSI. Guest Introspection is an NSX guest component, not a laptop sensor.
Full Explanation
The city must put Carbon Black Cloud prevention on Windows staff laptops already managed by Workspace ONE UEM. Deploy the CB Defense sensor with a signed Workspace ONE UEM software-distribution payload—physical laptops need the real agent, like installing a smoke detector in the office rather than pointing the building sprinkler panel at a notebook. Enabling NSX Guest Introspection on the laptop VLAN so VMware Tools becomes the endpoint sensor fails by concept because Guest Introspection is an NSX guest security component, not the Carbon Black Cloud sensor for physical Windows endpoints. Pushing an NSX-T Service Insertion policy to each physical laptop NIC fails because Service Insertion applies in the SDDC service path, not as agent install on staff laptops. Publishing the Windows MSI as an NSX Identity Firewall rule instead of an agent fails because Identity Firewall rules classify identity-based network traffic and do not install MSI packages. Exam caveat: staff Windows laptops get CB Defense via UEM software distribution (or equivalent package deploy)—not GI, Service Insertion, or IDFW-as-installer. Operational check: assign the signed sensor package in UEM, confirm laptops check into Carbon Black Cloud under the intended policy, and verify operations runbooks no longer mention GI or Service Insertion as the laptop sensor path. Track sensor versions in the UEM assignment so citywide upgrades remain controlled and auditable.