Exam CISSP topic 1 question 427 discussion

The solution that will BEST enforce the security requirements for a bring your own device (BYOD) program, where only devices with up-to-date antivirus and operating system (OS) patches are allowed on the network, is: D. Network Access Control (NAC). Network Access Control (NAC) is specifically designed for controlling and managing access to a network based on various security policy requirements.

D NAC can check device health state and compliance with security policies before allowing network access. It can verify antivirus, OS patching level, and other desired posture criteria are met. Non-compliant devices can be denied access or quarantined. The other options cannot enforce these pre-connection access controls: A) Endpoint Detection and Response validates and responds to threats post-access but does not restrict initial network admission. B) Next-Generation Firewalls filter traffic but do not validate BYOD device state upfront. C) IDS/IPS monitors traffic but does not authenticate and authorize devices.

how are you going to enforce policy on a BYOD ?

Network access control (NAC) is a security solution that enforces policy on devices that access networks to increase network visibility and reduce risk