Question

A security architect is planning endpoint monitoring for a fleet of company laptops that frequently leave the corporate network and connect from home and public Wi-Fi. Management requires continuous telemetry, local process inspection, and the ability to enforce policy even when a device is offline from the corporate LAN. Which deployment approach best satisfies these requirements?

Accepted Answer

An agent-based (host-based) deployment that installs software directly on each endpoint

Answer

An agentless deployment that relies on periodic authenticated network scans from a central scanner

Answer

A network tap feeding a passive IDS sensor at the corporate perimeter

Answer

A SPAN port mirroring traffic to a network-based collector in the data center