A company is migrating from a legacy NAC solution to Cisco ISE. They have a large number of endpoints that already have a third-party posture agent installed. They want to use Cisco ISE posture assessment, but they do not want to force users to uninstall the third-party agent. They also need to ensure that the Cisco posture agent is installed on all endpoints. What is the best approach?

Use the third-party agent's API to integrate with ISE.

Skip posture assessment for endpoints that have the third-party agent.

Use client provisioning to install the Cisco posture agent alongside the third-party agent, and configure the posture policy to check for the Cisco agent's presence.

Require users to manually uninstall the third-party agent before they can access the network.

A university has a BYOD program where students can connect their personal devices to the campus network. They want to enforce posture checks, but they are concerned about privacy and do not want to require students to install a persistent agent. They also want to allow students to access the internet even if they are non-compliant, but with limited bandwidth. What is the best way to achieve this?

Use a web-based posture check that runs in the browser without installing an agent.

Require the AnyConnect agent and block non-compliant devices entirely.

Use a posture policy with a 'monitor' mode that does not block access but logs compliance, and apply a bandwidth limit to non-compliant devices via an authorization profile.

Skip posture assessment for BYOD devices and rely on the guest portal.

A network team is troubleshooting a posture assessment issue where endpoints are not receiving the posture agent from ISE. The endpoints are able to authenticate and receive an IP address, but the client provisioning does not seem to be working. The team has verified that the client provisioning policy is correctly configured and that the agent files are available. What is the most likely cause?

The endpoints are not in the correct identity group that the client provisioning policy is assigned to.

The ISE node is not licensed for posture.

The posture agent is already installed and ISE is skipping provisioning.

The network access device is not configured to allow HTTP redirects for client provisioning.

A financial institution uses Cisco ISE for posture assessment. They have a posture condition that checks for the presence of a specific antivirus product and its definition version. Recently, they updated the antivirus product to a new version, and now all endpoints are being marked as non-compliant. The security team wants to update the posture condition to reflect the new version without causing a service disruption. What is the best approach?

Update the posture condition to check for the new antivirus version and test it in a lab before applying to production.

Disable the posture condition temporarily to allow all endpoints access.

Create a new posture policy that allows both old and new versions, and gradually migrate endpoints.

Immediately update the posture condition in production to the new version.

A company has a mixed environment with both corporate-managed and BYOD devices. They want to use client provisioning to deliver the posture agent to all devices, but they have different requirements: corporate devices should receive the AnyConnect agent with a specific profile, while BYOD devices should receive a lighter agent with limited permissions. What is the best way to achieve this in ISE?

Use a single client provisioning policy that delivers the same agent to all devices.

Manually install the appropriate agent on each device.

Create separate client provisioning policies for corporate and BYOD identity groups, each with the appropriate agent and profile.

Configure the posture policy to require different agents based on the device's OS.

CCIE Security

Domain 4Objective 9

4.9 Posture Assessment with Cisco ISE CCIE-SECURITY Practice Questions (Page 5)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

25%of the exam

Questions 21–25

21expert · hard
A company is migrating from a legacy NAC solution to Cisco ISE. They have a large number of endpoints that already have a third-party posture agent installed. They want to use Cisco ISE posture assessment, but they do not want to force users to uninstall the third-party agent. They also need to ensure that the Cisco posture agent is installed on all endpoints. What is the best approach?
Select an answer first
22expert · hard
A university has a BYOD program where students can connect their personal devices to the campus network. They want to enforce posture checks, but they are concerned about privacy and do not want to require students to install a persistent agent. They also want to allow students to access the internet even if they are non-compliant, but with limited bandwidth. What is the best way to achieve this?
Select an answer first
23expert · hard
A network team is troubleshooting a posture assessment issue where endpoints are not receiving the posture agent from ISE. The endpoints are able to authenticate and receive an IP address, but the client provisioning does not seem to be working. The team has verified that the client provisioning policy is correctly configured and that the agent files are available. What is the most likely cause?
Select an answer first
24expert · hard
A financial institution uses Cisco ISE for posture assessment. They have a posture condition that checks for the presence of a specific antivirus product and its definition version. Recently, they updated the antivirus product to a new version, and now all endpoints are being marked as non-compliant. The security team wants to update the posture condition to reflect the new version without causing a service disruption. What is the best approach?
Select an answer first
25expert · hard
A company has a mixed environment with both corporate-managed and BYOD devices. They want to use client provisioning to deliver the posture agent to all devices, but they have different requirements: corporate devices should receive the AnyConnect agent with a specific profile, while BYOD devices should receive a lighter agent with limited permissions. What is the best way to achieve this in ISE?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

4.9 Posture Assessment with Cisco ISE CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

Keep studying — 4.0 Identity Management, Information Exchange, and Access Control