4.11 Integration of MDM with Cisco ISE CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is deploying Cisco ISE to enforce access policies for corporate-owned smartphones and tablets. They want ISE to evaluate each device's compliance status (e.g., jailbroken, missing required apps) before granting network access. Which integration approach should they use?

   • AConfigure the MDM server as a RADIUS server and have it authenticate all mobile devices directly.
   • BUse ISE's built-in posture agent to check for jailbreak and required apps on mobile devices.
   • CManually create a static list of compliant device MAC addresses in ISE and update it weekly.
   • DIntegrate ISE with an MDM server using REST API and configure MDM compliance attributes in authorization policies.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An administrator notices that ISE is not receiving compliance updates from the MDM server. The MDM server is reachable from ISE via ping, but the API connection fails. What should the administrator check first?

   • AEnsure that the MDM server is configured with a shared secret.
   • BCheck if the MDM server's firewall is blocking HTTPS traffic.
   • CVerify that the API credentials are correct and have the required permissions.
   • DRestart the ISE services.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large enterprise has multiple MDM servers (one for each region) and wants to integrate them all with a single ISE deployment. They want to enforce consistent access policies across all regions. What is the best approach?

   • AUse a third-party integration tool to synchronize all MDM data into one database.
   • BUse a single MDM server that aggregates data from all regional MDMs.
   • CCreate separate ISE deployments for each region.
   • DConfigure each MDM server as a separate MDM server in ISE and create authorization policies that reference the appropriate MDM server based on the device's region.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An administrator is integrating a new MDM server with ISE. The MDM server uses a self-signed certificate. The administrator wants to ensure secure communication without compromising security. What should they do?

   • AUse HTTP instead of HTTPS to avoid certificate issues.
   • BImport the self-signed certificate into ISE's trusted certificate store and ensure the hostname matches the certificate.
   • CDisable certificate validation in ISE for this MDM server.
   • DAsk the MDM vendor to issue a certificate from a public CA.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has ISE integrated with an MDM. They notice that some devices are marked as compliant by the MDM but are still denied access by ISE. The ISE logs show that the MDM compliance attribute is 'Compliant' but the authorization policy is not matching. What could be the issue?

   • AISE is not polling the MDM server frequently enough.
   • BThe MDM server is not sending compliance data to ISE.
   • CThe authorization policy is using a different attribute name than what ISE receives from the MDM.
   • DThe devices are not registered with the MDM.
   Reveal Solution Discussion Select an answer first