Ring Rollout on a Metered WAN
Vantage Retail has 12,400 endpoints across three regions. About 2,100 sit behind metered satellite links with a 500 MB daily cap shared with point-of-sale traffic. Another 3,800 are Windows 10 machines with 4 GB RAM and spinning disks. The current antivirus is being replaced; a 150-endpoint pilot in IT ran for six weeks in audit mode with no major incidents. During a limited block-mode test, 23 alerts in the engineering department were confirmed false positives caused by a custom build tool. The change freeze starts in five weeks. The deployment team has four engineers, one of whom is on leave for two of those weeks. Content updates are pulled from the vendor cloud; there is no on-premises distribution point yet. The pilot covered only laptops, not servers or point-of-sale terminals.
1. Design the rollout rings, with entry and exit criteria, that fit the five-week window and the staffing constraint. Justify the order and explain how you would treat the metered sites.
Read the worked answer
Rings should follow blast radius and reversibility, not org chart.
Ring 0 (week 1): the 150 pilot endpoints plus 50 security and helpdesk endpoints in block mode. Exit: crash rate below 0.5 percent, no boot failures, update success above 98 percent, fewer than 5 confirmed false positives per 1,000 endpoints per week, and helpdesk volume within 10 percent of baseline.
Ring 1 (week 2): 600 endpoints in one region, mixed hardware, including 100 low-RAM devices and the engineering build-tool group. Same exit criteria plus CPU impact under 5 percent on 4 GB devices.
Ring 2 (weeks 3-4): 4,000 general office endpoints.
Ring 3 (week 5): remaining standard endpoints.
Metered sites stay outside the five-week window unless content can be staged locally. A 500 MB daily cap shared with POS cannot absorb agent and content traffic. Measure actual update size first, then schedule off-peak with bandwidth caps, or deploy a local distribution point. Start those sites in audit mode.
With one engineer on leave, do not open a new ring during that period. Split Ring 2 or defer it. The engineering false positives belong in Ring 1 so they are fixed before broad deployment.
2. What configuration decisions would you make for the 4 GB RAM endpoints and for the engineering team's build tool, and why?
Read the worked answer
For 4 GB endpoints: enable only modules with proven value, defer memory-heavy features such as full memory scanning and aggressive first-run ML, throttle scans and CPU use, and measure boot time and disk queue before and after. If performance is unacceptable, keep the endpoint in audit mode rather than disabling protection. A slow endpoint invites users to ask for the agent to be removed, which is a worse outcome.
For the build tool: do not exclude the build directory wholesale. Use a process exclusion for the build executable plus a path exclusion limited to its output directory, with a signer condition, and run in audit mode for two weeks to size the false-positive volume. If the tool writes to a user-writable directory, reject the path exclusion and ask engineering to move output to a dedicated volume with a restricted ACL.
The reasoning: exclusions are permanent blind spots, not performance settings. A path exclusion on a writable directory is an attacker shortcut. Process, signer, and path narrow the blind spot to a known binary and location. Audit data gives the change board evidence rather than an assertion.
3. Define rollback triggers and the minimum evidence needed to declare a ring successful.
Read the worked answer
Rollback triggers: boot failure on more than 0.2 percent of a ring, a confirmed malware execution the platform missed but the prior antivirus caught, update failure above 5 percent, or helpdesk volume doubling for two consecutive days. Rollback means reverting policy to audit, not uninstalling, unless endpoints are unusable.
Declaring success needs more than no incidents. Minimum evidence: seven days of telemetry at expected volume, false-positive rate per 1,000 endpoints, crash and boot metrics, update success, and a sample of 20 alerts reviewed by a second analyst. Document ring size and open date.
Any endpoint that cannot run the agent needs a documented risk acceptance and a compensating control, not a silent exemption. Because the freeze starts in five weeks, Ring 3 may slip; publish that trade-off early instead of compressing validation.