4.11 Integration of MDM with Cisco ISE CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   Users report that their compliant Android devices are being denied network access by ISE. The MDM integration was working before. The administrator checks the ISE logs and sees that the MDM server is reachable, but the compliance attributes show 'unknown' for all devices. What is the most likely cause?

   • AThe MDM server is not configured with the correct compliance policies.
   • BThe devices are not connected to the corporate Wi-Fi.
   • CThe API credentials used by ISE have expired or been changed.
   • DISE's posture agent is not installed on the Android devices.
   Reveal Solution Discussion Select an answer first
2. 27application · easy

   A financial firm wants to use ISE to enforce that only company-managed iPhones can access the internal network. They have an MDM solution that can provide device inventory and compliance status. What is the primary benefit of integrating MDM with ISE in this scenario?

   • AISE can authenticate users using the MDM database.
   • BISE can automatically quarantine non-compliant devices and provide real-time visibility.
   • CISE can push software updates to the iPhones.
   • DISE can replace the MDM server for device management.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An administrator is configuring MDM integration in ISE. They have entered the MDM server's URL and API credentials. However, when testing the connection, ISE returns a certificate error. What should the administrator do to resolve this?

   • ARe-enter the API credentials.
   • BChange the MDM server to use HTTP instead of HTTPS.
   • CDisable SSL verification in ISE for the MDM server.
   • DImport the MDM server's CA certificate into ISE's trusted certificate store.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A university uses ISE with MDM integration to control access for student-owned laptops and smartphones. They want to allow full access only if the device is compliant with the MDM policy (e.g., encryption enabled, no jailbreak). For non-compliant devices, they want to provide limited access to a remediation network. How should this be implemented?

   • ASet the authentication policy to require MDM compliance before authentication.
   • BCreate authorization policies that check MDM compliance attributes and assign different VLANs.
   • CConfigure the MDM server to block non-compliant devices from the network.
   • DUse the posture policy to check compliance and assign VLANs.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is setting up MDM integration with ISE. They want to ensure that when a device is reported as lost or stolen, it is automatically denied network access. What is the best way to achieve this?

   • AUse the posture agent to detect lost devices.
   • BConfigure ISE to periodically poll the MDM for lost status.
   • CUse the MDM's lost mode feature, which updates the device status in the MDM, and ISE will reflect this in compliance attributes.
   • DManually block the device's MAC address in ISE.
   Reveal Solution Discussion Select an answer first