4.11 Integration of MDM with Cisco ISE CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An administrator is troubleshooting an MDM integration where ISE is unable to retrieve compliance data. The MDM server is reachable, and the API credentials are correct. The administrator suspects a certificate issue. What is the best way to verify this?

   • ATemporarily disable certificate validation in ISE to see if the connection works.
   • BUse a tool like openssl to check the MDM server's certificate chain and ensure it is trusted by ISE.
   • CRestart the ISE services to clear any cached certificate issues.
   • DCheck the ISE logs for certificate-related errors.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An administrator is configuring a new MDM server in Cisco ISE. They have the server's hostname, API username, and password. After saving the configuration, ISE cannot reach the MDM server. What is the most likely cause?

   • AThe MDM server's API certificate is not trusted by ISE.
   • BThe MDM server must be configured as a network device in ISE.
   • CISE does not support MDM integration via API.
   • DThe MDM server is not configured with a shared secret.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is implementing MDM integration with ISE. They want to ensure that when a device is unregistered from the MDM, it is immediately denied network access. What is the best way to achieve this?

   • AThe MDM server will send a CoA to ISE to terminate the session.
   • BThe device will be denied access only after the session expires.
   • CISE will automatically detect the unregistration via API and update the device's compliance status, which can be used to deny access.
   • DThe administrator must manually block the device in ISE.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A hospital uses Cisco ISE to control network access for staff iPads. The MDM integration is configured. They want to allow full network access only if the iPad is not jailbroken and has the required 'SecureHealth' app installed. What should the administrator configure in ISE?

   • ACreate an authorization policy that checks MDM compliance attributes and permits access if compliant.
   • BConfigure the MDM server to block non-compliant devices at the network level.
   • CSet the authentication policy to require MDM compliance before authentication.
   • DUse the posture policy to check for jailbreak and app installation.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is implementing MDM integration with ISE. They want the workflow to be: when a new device connects, ISE checks if it is registered with the MDM; if not, the device is redirected to a registration portal. After registration, the device is re-evaluated and granted access based on compliance. Which ISE feature enables this workflow?

   • AGuest access with a captive portal for device registration.
   • BMDM integration with a registration portal and re-authentication on state change.
   • CPosture policy with a remediation script that installs the MDM agent.
   • DRADIUS Change of Authorization (CoA) to force re-authentication after registration.
   Reveal Solution Discussion Select an answer first