Question
A security engineer is reviewing event logs because an employee successfully connected a personal Windows laptop to the corporate network, which is against company policy. Company policy allows all Windows 10 and 11 laptops to connect to the system as long as the MDM agent installed by IT is running. Only compliant devices can connect, and the logic in the system to evaluate compliant laptops is as follows:
```python
if laptop['OsVersion'] >= 10:
if laptop['agentRunning']:
return COMPLIANT
else:
return NON_COMPLIANT
else:
return COMPLIANT
```
Which of the following most likely occurred when the employee connected a personally owned Windows laptop and was allowed on the network?
- A. The agent was not running on the laptop, which triggered a false positive.
- B. The OS was a valid version, but the MDM agent was not installed, triggering a true positive.
- C. The OS was running a Windows version below 10 and triggered a false negative. Correct
- D. The OS version was higher than 11, and the MDM agent was running, triggering a true negative.
Explanation
The else branch returns COMPLIANT for any OS version below 10, so an old, unmanaged Windows laptop is accepted without any agent check. The system failed to detect a noncompliant device, which is a false negative. If the OS were version 10 or higher without a running agent, the logic would correctly return NON_COMPLIANT and block it, so options A and B do not explain the laptop being allowed. Option D describes a device that really is compliant, not a policy violation.
