Library helpdesk analysts can see Carbon Black Cloud alerts but cannot isolate a compromised kiosk. NSX-T is not in the kiosk path. What should the security administrator fix?

When library helpdesk analysts can see Carbon Black Cloud alerts but cannot isolate a compromised kiosk and NSX-T is not in the kiosk path, grant the helpdesk Carbon Black Cloud role the device isolate and Live Response permissions. Alert visibility alone is not remediation authority; isolate and Live Response are separate RBAC rights needed to contain a civic kiosk. Fixing the role restores operational response without inventing NSX paths that do not exist. Adding the kiosks to an NSX-T Identity Firewall group so isolation happens at the T1 gateway fails by concept because NSX-T is not in the kiosk path and IDFW groups do not grant CBC isolate rights. Publishing RDP from the internet to each kiosk so helpdesk can pull the network cable remotely fails by concept because exposing RDP from the internet increases compromise risk and is not CBC isolation. Disabling the Carbon Black Cloud sensor and relying on Workspace ONE Access SSO to quarantine fails by concept because Access SSO does not quarantine endpoints and removing the sensor removes prevention. Exam caveat: seeing alerts is not the same as isolate/Live Response permission—fix CBC RBAC when NSX is out of path. Operational check: update the helpdesk CBC role with isolate and Live Response, test isolate on a lab kiosk, confirm production kiosk containment works, and document RBAC in the library incident-response runbook for civic public-access endpoints.