How would you enforce device compliance before granting access?

• A. Device health checks, endpoint management, device inventory, patch status, MDM/EMM.
• B. Allow access from any device without checks.
• C. Only require password strength.
• D. Check device location only.

Answer: (A)

Enforcing device compliance before granting access hinges on evaluating the device’s posture through a set of managed checks. By performing device health checks, you verify that the device is operating normally and free from known issues. Endpoint management and device inventory confirm the device is enrolled, known, and under IT control, so it can be enforced with policies. Patch status ensures the device has current security updates, reducing vulnerability to exploits. MDM/EMM provides the framework to apply and enforce security configurations, such as encryption, passcodes, app controls, and allowed OS versions, and can block access or remediate if noncompliant. When all these criteria are met, access is granted only to devices that meet the security requirements, reflecting a zero-trust approach where trust is based on verified device posture.

Relying on any single factor like allowing any device, only requiring a password, or checking location alone does not verify the necessary security state and would leave gaps that attackers could exploit.