Public health needs both partner antivirus offload through NSX Guest Introspection and Carbon Black Cloud prevention on the same EHR VMs. Staff believe the Thin Agent replaces the CB Defense sensor. What should be installed?
Select an answer to reveal the explanation.
Short Explanation
GI is the hypervisor’s peek into the guest for partner AV. Carbon Black is the cloud prevention sensor on the endpoint. Different jobs, same VM—install both when you need both.
Full Explanation
Public health needing both partner antivirus offload through NSX Guest Introspection and Carbon Black Cloud prevention on the same EHR VMs must install both the Guest Introspection Thin Agent and the Carbon Black Cloud sensor. They enforce different layers: GI enables NSX partner introspection/offload, while CBC provides its cloud prevention stack—the Thin Agent does not replace the CB Defense sensor.
Installing only Guest Introspection is wrong when Carbon Black prevention is required. Installing only the CB Defense sensor is wrong when partner AV offload through NSX GI is required; CBC does not register as the NSX partner SVM merely by being present. Installing neither because Layer-4 DFW rules exist leaves both GI offload and CBC prevention unmet.
Exam caveat: Thin Agent and CB sensor are complementary, not mutually exclusive substitutes.
Operational check: deploy both agents per image standard, verify GI partner health and CBC prevention online on EHR VMs, and record the dual-agent requirement in the public-health endpoint architecture.
Dual-agent EHR standards (GI Thin Agent + CBC sensor) are defense-in-depth for public health, not duplication. Compliance scans should fail hosts missing either agent, and architecture docs should state which malware and introspection outcomes each agent owns.