Question

A security engineer must ensure that corporate Windows endpoints are running a specific host-based DLP service before granting full network access through ISE posture. If the service is stopped, the endpoint should be marked noncompliant and prompted to remediate. Which posture condition type should the engineer configure to evaluate whether the DLP service is currently running on the endpoint?

Accepted Answer

A Service Condition that checks the service status (running/stopped) as part of the posture requirement

Answer

A Registry Condition that verifies the DLP application's installation key exists under HKLM

Answer

An Anti-Malware Condition that validates the DLP product's definition file age

Answer

A File Condition that confirms the DLP executable exists in the Program Files directory