Courts firewalls deny all outbound traffic except an allowlist of SaaS destinations. Sensors will appear offline after install unless which step happens first?
Select an answer to reveal the explanation.
Short Explanation
The sensor is a two-way radio that only works if the tower is on the allowlist. Open the documented Carbon Black Cloud destinations first or the SOC just sees a graveyard of offline devices. SMB to NSX Manager and GI packaging do not give the agent its cloud path.
Full Explanation
Courts firewalls deny all outbound traffic except an allowlist of SaaS destinations. Sensors will appear offline after install unless the documented Carbon Black Cloud sensor destinations and ports are allowed before rolling out the agent—the sensor is a two-way radio that only works if the tower is on the allowlist. Opening SMB from every courtroom VLAN to the NSX-T Manager fails by concept because SMB to NSX Manager is unrelated to CBC cloud connectivity and widens lateral exposure. Disabling TLS inspection only for vRealize Network Insight collectors fails because vRNI collector exceptions do not provide the CBC sensor’s required destinations. Publishing the CB Defense sensor as a Guest Introspection service so it never needs the internet fails because packaging myths do not remove the need for documented CBC cloud connectivity for cloud-delivered prevention. Exam caveat: before CBC rollout behind deny-all egress, allowlist documented sensor destinations and ports—not SMB to NSX, not vRNI TLS exceptions, not GI packaging to avoid the internet. Operational check: open the documented CBC destinations, install a pilot sensor, confirm online status in the console, then scale rollout; keep a deny-all baseline otherwise intact. Store the CBC destination list in the courts firewall standard next to other SaaS allowlists.