Public-health analysts cannot run Live Query / Audit and Remediation on a subset of clinics. Endpoint Standard sensors are online. What should the security administrator verify first?
Select an answer to reveal the explanation.
Short Explanation
Live Query is a different toolkit than Endpoint Standard. Confirm the clinic devices have Audit and Remediation or Enterprise EDR and a sensor that actually supports it.
Full Explanation
When public-health analysts cannot run Live Query / Audit and Remediation on a subset of clinics while Endpoint Standard sensors are online, verify first whether those devices have the Audit and Remediation or Enterprise EDR entitlement and a supporting sensor. Live Query and Audit and Remediation require the correct CBC entitlement and sensor capability; Endpoint Standard online alone does not unlock every investigation feature for civic clinics. Whether those clinics have an NSX-T DFW section named Audit fails by concept because DFW section names do not enable CBC Live Query or Audit and Remediation. Whether Workspace ONE Access MFA is disabled so queries can run as local admin fails by concept because disabling MFA is unrelated and unsafe; Access MFA does not gate CBC Live Query entitlement. Whether Guest Introspection VIB is installed on the ESXi hosts under the clinics fails by concept because GI VIBs on ESXi do not grant CBC Audit and Remediation on clinic endpoints. Exam caveat: Live Query/A&R needs entitlement and supporting sensor—do not hunt NSX section names, Access MFA, or GI VIBs for that feature gap. Operational check: confirm A&R or Enterprise EDR licensing and sensor type on the affected clinics, upgrade or reassign as needed, run a test Live Query, and document entitlement mapping in the public-health CBC service catalog for civic clinical IR.