A city needs Guest Introspection on VDI guests so Identity Firewall and file introspection can see in-guest events. Staff are about to push only a Carbon Black MSI. What should be installed for Guest Introspection?
Select an answer to reveal the explanation.
Short Explanation
Guest Introspection rides inside VMware Tools—the thin agent, not the Carbon Black installer. CB is a different bodyguard. You still need the Tools drivers if NSX must peek in the guest.
Full Explanation
City VDI guests that need Guest Introspection for Identity Firewall and file introspection require VMware Tools with the Guest Introspection file and network introspection drivers. Pushing only a Carbon Black MSI does not install the NSX thin agent components inside Tools that GI depends on.
Only the Carbon Black Cloud sensor MSI does not replace the NSX thin agent for Guest Introspection. A Workspace ONE UEM compliance profile that marks the VM as introspected is a label, not GI drivers. An NSX distributed IDS signature pack without VMware Tools does not enable in-guest GI events.
Exam caveat: GI rides in VMware Tools drivers; CBC is a complementary endpoint stack, not a Tools substitute.
Operational check: install/upgrade Tools with GI components on pilot VDI, verify GI health, confirm IDFW or file introspection events, and update the golden image standard before fleet push.
Tools-with-GI on VDI is non-negotiable when IDFW needs in-guest truth. Bake GI components into images, block pool admission if GI drivers are missing, and treat CBC MSI-only pushes as incomplete for GI-dependent civic use cases. Keep Tools/GI component evidence from a pilot VDI pool with the image change record so the next on-call engineer can reject CBC-only pushes when Guest Introspection is required without rediscovering agent boundaries under pressure.