Transit bus-yard endpoints have Carbon Black Cloud sensors installed, but prevention never applies. Group criteria never match, and someone deleted the Standard policy. What should the security administrator restore first?

When transit bus-yard endpoints have Carbon Black Cloud sensors installed but prevention never applies because group criteria never match and someone deleted the Standard policy, recreate a default Carbon Black Cloud policy and assign it through a matching sensor group first. Sensors without an assigned policy enforce nothing useful; restoring a default policy and correct group criteria returns prevention to civic yard endpoints. Creating an NSX-T security group for the yard VLAN and relying on DFW as the endpoint policy fails by concept because DFW is network micro-segmentation, not CBC endpoint prevention policy assignment. Uninstalling the sensors and enrolling the buses only in Workspace ONE Access fails by concept because Access SSO enrollment does not provide Carbon Black prevention. Tagging the endpoints in vCenter so Guest Introspection assigns a DFW section fails by concept because these are endpoints with CBC sensors, not a GI-to-DFW substitute for deleted CBC policy. Exam caveat: CBC prevention requires an assigned policy via matching sensor groups—NSX groups, Access, or GI tags do not replace that assignment. Operational check: recreate a default CBC policy, fix sensor-group criteria for the yard, confirm prevention applies on a pilot endpoint, and protect the Standard policy from accidental deletion in the transit CBC administration guide for municipal fleet security.