4.9 Posture Assessment with Cisco ISE CCIE-SECURITY Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A hotel offers guest Wi-Fi access and wants to use Cisco ISE posture assessment for guest devices. They want to ensure that guest devices have antivirus software running before granting internet access. However, guests are not allowed to install any software on their devices. What is the best approach?

   • AUse web-based posture assessment that checks for antivirus without installing an agent.
   • BUse a remediation action that installs antivirus on the guest device.
   • CSkip posture assessment for guest devices and only require acceptance of the acceptable use policy.
   • DRequire guests to install the AnyConnect agent before accessing the network.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   An organization uses Cisco ISE for network access control. They have a posture policy that checks for antivirus definitions. When an endpoint is non-compliant, they want to allow the user to access only the internet and a remediation server, but not internal resources. What is the most effective way to achieve this in Cisco ISE?

   • AConfigure a remediation action that redirects the user to a remediation portal and applies a restrictive ACL.
   • BCreate a separate posture condition for antivirus and apply it only to guest users.
   • CSet the posture policy to 'Non-Compliant' and assign a VLAN that has no network access.
   • DUse client provisioning to install the antivirus software automatically on the endpoint.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   An administrator is reviewing ISE reports to monitor posture compliance. They notice that a large number of endpoints are marked as 'Non-Compliant' even though they have the required software installed. The administrator suspects that the posture conditions are not correctly detecting the software. What should the administrator do to confirm this?

   • AVerify that the posture policy is assigned to the correct network access profile.
   • BCheck the client provisioning policy to ensure the agent is up to date.
   • CCheck the posture assessment report for the specific endpoints to see which condition failed.
   • DReview the AnyConnect agent logs on the endpoints to see if the software is detected.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company is rolling out posture assessment to a mix of Windows and macOS endpoints. They want to automatically deliver the correct posture agent to each endpoint based on its operating system during the initial authentication. Which Cisco ISE feature should be used to achieve this?

   • APosture policy with OS-specific conditions.
   • BNetwork access profile with separate authentication policies for each OS.
   • CRemediation actions that install the agent on the endpoint.
   • DClient provisioning with posture agent profiles for each OS.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A university allows students to connect their personal laptops to the campus network. They want to ensure that these BYOD devices have up-to-date antivirus software before granting full access. If a device is non-compliant, the student should be able to access a web portal to install the antivirus. What should the administrator configure in Cisco ISE?

   • AUse client provisioning to install the antivirus on the student's laptop automatically.
   • BSet the posture policy to 'Unknown' for BYOD devices and allow full access.
   • CCreate a posture policy for BYOD devices and configure a remediation action that redirects to a portal with the antivirus installer.
   • DAssign a guest VLAN to all BYOD devices and require them to register through the guest portal.
   Reveal Solution Discussion Select an answer first