Endpoint Protection Rollout, Exclusions, and Offline Endpoints
A hospital system has 14,000 Windows endpoints, 2,500 macOS devices, and 800 Windows servers. It is replacing legacy AV with Cisco Secure Endpoint. The pilot covers 500 endpoints. After migration, 3% of endpoints take more than 90 seconds to log in, two Oracle database servers show sustained 85% CPU after the connector install, 400 endpoints have not checked in for 21 days, and a ransomware event encrypted a file share from a workstation that had a broad exclusion for a clinical application folder. The CIO wants the rollout completed in 60 days and asks whether to disable exploit prevention to improve performance.
1. Triage the login delays and server CPU. Design exclusions and decide whether to disable exploit prevention.
Read the worked answer
Login delays often come from synchronous scanning of user profiles, roaming profiles, or legacy applications; server CPU often comes from real-time scanning of database files. Do not disable exploit prevention as a first move, because it lowers protection and does not address file-scanning CPU. Use vendor-documented exclusions for Oracle data files, logs, and temp directories, plus process exclusions for the database binaries. Keep exclusions narrow and documented. For login, exclude only the specific legacy application path or process, not the whole user profile. Determine whether the delay occurs at logon, during GPO scripts, or at application launch. Test on canary servers with performance counters before and after. If CPU remains high, tune scan modes and schedule full scans off-hours. Escalate to vendor support with connector logs if exclusions do not resolve the issue.
2. What should be done about 400 endpoints that have not checked in for 21 days, and how should policy treat them?
Read the worked answer
First determine whether the endpoints are powered off, isolated, or unable to reach the cloud. Check connector version, proxy and TLS inspection, and endpoint clock. Set an offline grace period and a maximum missed-check-in policy, and use conditional access or ISE posture to limit network access for stale endpoints. For endpoints that cannot check in, quarantine or require remediation rather than silently allowing them. For remote users, ensure the connector can reach the cloud through the SIG or proxy, and that TLS inspection bypasses the connector's pinned cloud endpoints. Report stale endpoints weekly to the CIO, because a 60-day rollout that ignores 400 unseen endpoints is not complete. Do not extend the grace period indefinitely; that converts a control into a reporting exercise.
3. Analyze the ransomware event and recommend exclusion governance. How should the 60-day deadline be handled?
Read the worked answer
The ransomware path was a broad exclusion for a clinical application folder; attackers used that blind spot. Remove or narrow the exclusion, add application control and exploit prevention, and verify file-share permissions and lateral-movement controls. Do not disable exploit prevention; tune it instead. Every exclusion should have an owner, business justification, expiry date, and compensating control, and should be reviewed monthly. Use device trajectory and file analysis to scope the incident, isolate affected endpoints, reset credentials, and check for lateral movement.
For the 60-day deadline, prioritize coverage and health over speed. A wave gate should require check-in rate, CPU baseline, and exclusion review. If the CIO insists on 60 days, cover critical servers first and extend endpoints with an explicit risk statement; do not trade away detection controls to meet a calendar date.