An organization has endpoints in various departments with different security needs. Which of the following group assignment strategies ensures that endpoints in sensitive departments, like finance, receive stricter security policies compared to other departments?

Using tags to dynamically assign endpoints to groups based on department-specific attributes is the most effective and scalable strategy. This method allows for automation, where endpoints are automatically placed into the correct policy group (e.g., "Finance," "Marketing") based on attributes from a directory service like Active Directory (e.g., Organizational Unit). This ensures that endpoints in sensitive departments consistently and automatically receive stricter, pre-defined security policies, minimizing manual effort and the potential for human error. This approach is a core principle of modern endpoint management for maintaining a robust and adaptable security posture.

A. Manual adjustment per endpoint is not a scalable strategy; it is highly prone to error and creates inconsistent security configurations across the organization.
C. Assigning groups based on IP addresses is unreliable, as IPs can be dynamic (DHCP) or change as devices move between networks, leading to incorrect policy application.
D. Network firewall settings and endpoint policy groups serve different purposes. Firewalls control network traffic, while policy groups manage host-level security controls; one does not replace the other. ---

1. Microsoft Corporation. (2023). Create and manage device groups in Microsoft Defender for Endpoint. Microsoft Learn.

Reference: In the section "Device group creation

" the documentation states

"You can create device groups... to assign specific security policies." It details how to define membership rules based on attributes like device name

domain

OS

and tags

which directly supports the dynamic assignment strategy. This allows administrators to "configure remediation actions" and policies based on group membership.

2. Palo Alto Networks. (2024). Cortex XDR Administrator’s Guide. Palo Alto Networks Technical Documentation.

Reference: In the chapter on "Endpoint Management

" the section "Manage Endpoint Groups" describes the creation of dynamic groups. It explains that endpoints can be automatically grouped using queries based on attributes such as "domain

" "organizational unit

" or "IP address." Using an attribute like an organizational unit is a direct implementation of the strategy described in the correct answer.

3. Souppaya

M.

& Scarfone

K. (2013). Guide for Security-Focused Configuration Management of Information Systems (NIST Special Publication 800-128). National Institute of Standards and Technology.

Reference: Section 3.2

"Establish Configuration Baselines

" discusses the importance of developing distinct baselines for different types of information systems based on their "functionality

and security and privacy requirements." This foundational principle supports the strategy of creating different policy groups for departments with varying security needs

such as finance. (DOI: https://doi.org/10.6028/NIST.SP.800-128)