ISC2 CISSP Practice Question

Network Access Control (NAC) is the appropriate solution because it can enforce endpoint health policies at the time a device attempts to join the network. Modern NAC platforms (for example, Cisco ISE or Aruba ClearPass) perform posture assessment by verifying antivirus currency, operating-system patch level, and host firewall status. Only devices that pass these checks are granted normal network access; noncompliant endpoints can be quarantined or remediated.

A virtual private network (VPN) primarily provides encrypted remote connectivity. While some vendors add optional posture plug-ins, standard VPN functionality alone does not evaluate endpoint health before access. IDS/IPS products monitor or block malicious traffic after it enters the network rather than vetting a device beforehand. Network segmentation restricts traffic flows once a device is connected but likewise does not assess endpoint security posture at admission time.