Which of the following is the MOST effective way to ensure the endpoint devices used by remote users are compliant with an organization's approved policies before being allowed on the network?

GPOs apply configuration and policy settings to devices already joined to an Active Directory domain, but they cannot evaluate or block non-compliant remote endpoints at the point of network entry.

NAC enforces posture assessment by inspecting endpoint devices for compliance with security policies-such as patch levels, antivirus status, and configuration-before admitting them to the network. If a device fails the posture check, NAC can quarantine it, deny access, or redirect it to a remediation VLAN, ensuring only compliant endpoints gain network entry. This pre-admission control is the core purpose of NAC solutions like Cisco ISE or Microsoft Network Policy Server.

MDM manages and enforces policies on enrolled mobile and endpoint devices, but it does not provide a network-level gate that blocks non-compliant devices before they connect to the network.

PAM controls and monitors privileged account access and credentials, which addresses insider and administrative account risk rather than endpoint compliance at the time of network admission.