A company has 5000 Windows users on its campus. Which two precautions should IT take to prevent WannaCry ransomware from spreading to all clients? (Choose two.)

While network segmentation and Dynamic ARP inspection are good security practices, they do not directly address the WannaCry vulnerability (SMB exploitation) as effectively as endpoint compliance and containment.

Network segmentation is crucial for containing the spread of malware like WannaCry, as isolating noncompliant or potentially infected endpoints severely limits the ransomware's ability to propagate laterally across the network.

This describes a form of network segmentation, but 'a user cannot enter the network of another department' is less precise than 'segment noncompliant endpoints' when specifically addressing ransomware containment and broad spread.

A posture check, often part of Network Access Control (NAC), verifies that endpoints meet specific security requirements (e.g., patched OS, updated antivirus) before granting network access, preventing unpatched devices susceptible to WannaCry from connecting.

Placing all users in a 'trusted segment' without further controls could facilitate rapid spread if an initial user device is compromised, as trust zones typically imply fewer restrictions, which is counterproductive for WannaCry prevention.