A company is deploying Cisco ISE posture assessment for a new Windows-based remote-access VPN. The security team wants to ensure that only endpoints with the latest Windows updates and a running antivirus can access the corporate network. They also want the posture agent to be automatically installed on endpoints that lack it. Which two actions must be performed in ISE to meet these requirements?

Enable posture assessment globally and configure a single condition for 'Windows' without specifying patch or antivirus details.

Create a posture policy with only antivirus conditions and rely on the user to manually install the agent.

Create a posture policy with conditions for OS version and antivirus status, and enable client provisioning to deliver the AnyConnect posture agent.

Use the default posture policy and configure the VPN gateway to enforce compliance without ISE client provisioning.

A small business is setting up Cisco ISE for the first time. They have a mix of Windows and Mac endpoints. They want to use the native posture agent for Windows and the AnyConnect posture agent for Mac. They also want to ensure that the correct agent is delivered to each endpoint automatically. What should they configure in ISE?

Use a single provisioning policy that installs AnyConnect on all endpoints.

Configure the posture policy to require the AnyConnect agent on all endpoints.

Configure client provisioning with separate provisioning policies for Windows and Mac, each specifying the appropriate agent.

Manually install the agents on each endpoint and skip client provisioning.

A hotel offers guest Wi-Fi to visitors. They want to provide internet access to guests, but they also want to ensure that guest devices are not infected with malware that could harm the network. They decide to use Cisco ISE posture assessment for guest access. What is the best way to implement this?

Require guests to install the AnyConnect agent before accessing the internet.

Use a simple captive portal for guests and skip posture assessment.

Create a guest posture policy that checks for basic security (e.g., OS updates, antivirus) and redirects non-compliant guests to a remediation portal.

Do not apply posture to guests because they are not employees.

A network administrator is troubleshooting why some endpoints are not being assessed by Cisco ISE posture. The endpoints are running the posture agent, but they are not receiving any posture policy. What should the administrator check first?

Ensure that the posture agent is the latest version.

Check the endpoint's firewall settings to ensure the posture agent can communicate with ISE.

Verify that the posture policy is assigned to the correct network access profile and that the endpoint is in the correct identity group.

Reboot the endpoint and try again.

A large enterprise has a complex ISE deployment with multiple posture policies. They have a posture policy for corporate Windows laptops that requires antivirus, encryption, and specific patches. Recently, they have been experiencing issues where some endpoints are incorrectly marked as non-compliant even though they meet all requirements. The security team suspects that the posture conditions are too strict or misconfigured. They want to identify the root cause without affecting production. What should they do first?

Review the ISE logs for posture agent errors on the affected endpoints.

Use the posture assessment report to analyze the failure reasons for the affected endpoints and compare them with the expected conditions.

Disable the posture policy temporarily to allow all endpoints access.

Create a duplicate posture policy with monitor mode and assign it to a test group of endpoints.

CCIE Security

Domain 4Objective 9

4.9 Posture Assessment with Cisco ISE CCIE-SECURITY Practice Questions (Page 4)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

25%of the exam

Questions 16–20

16application · medium
A company is deploying Cisco ISE posture assessment for a new Windows-based remote-access VPN. The security team wants to ensure that only endpoints with the latest Windows updates and a running antivirus can access the corporate network. They also want the posture agent to be automatically installed on endpoints that lack it. Which two actions must be performed in ISE to meet these requirements?
Select an answer first
17application · medium
A small business is setting up Cisco ISE for the first time. They have a mix of Windows and Mac endpoints. They want to use the native posture agent for Windows and the AnyConnect posture agent for Mac. They also want to ensure that the correct agent is delivered to each endpoint automatically. What should they configure in ISE?
Select an answer first
18application · medium
A hotel offers guest Wi-Fi to visitors. They want to provide internet access to guests, but they also want to ensure that guest devices are not infected with malware that could harm the network. They decide to use Cisco ISE posture assessment for guest access. What is the best way to implement this?
Select an answer first
19application · medium
A network administrator is troubleshooting why some endpoints are not being assessed by Cisco ISE posture. The endpoints are running the posture agent, but they are not receiving any posture policy. What should the administrator check first?
Select an answer first
20expert · hard
A large enterprise has a complex ISE deployment with multiple posture policies. They have a posture policy for corporate Windows laptops that requires antivirus, encryption, and specific patches. Recently, they have been experiencing issues where some endpoints are incorrectly marked as non-compliant even though they meet all requirements. The security team suspects that the posture conditions are too strict or misconfigured. They want to identify the root cause without affecting production. What should they do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

4.9 Posture Assessment with Cisco ISE CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

A network administrator is troubleshooting why some endpoints are not being assessed by Cisco ISE posture. The endpoints are running the posture agent, but they are not receiving any posture policy. What should the administrator check first?

Keep studying — 4.0 Identity Management, Information Exchange, and Access Control