Which component triggers the quarantine of an infected endpoint?

Question

Options

• AALG
• Bfirewall
• CPolicy Enforcer
• Dswitch

• B
  3% (1)
• C
  91% (32)
• D
  6% (2)

Explanation

Policy Enforcer is the component specifically designed to act on threat intelligence by enforcing security policies - including isolating (quarantining) an infected endpoint from the rest of the network. It receives threat signals from detection systems and pushes enforcement actions to network devices.

Why the distractors are wrong:

• A. ALG (Application Layer Gateway) - Handles protocol-specific traffic translation (e.g., FTP, VoIP/SIP through NAT); it inspects and modifies packets but has no role in endpoint quarantine decisions.
• B. Firewall - Filters traffic based on pre-defined rules but does not dynamically trigger quarantine actions against infected hosts; it enforces access policies, not remediation responses.
• D. Switch - A Layer 2 forwarding device that can be instructed to move an endpoint to a quarantine VLAN, but it executes the action - it does not trigger or decide it.

Memory tip: Think of it this way - the Policy Enforcer enforces the policy. When a threat is detected, something has to decide to quarantine and tell the network to act. That decision-maker is the Policy Enforcer (common in frameworks like Juniper's Security Director).

No community discussion yet for this question.