4.9 Posture Assessment with Cisco ISE CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company allows guests to access the internet via a guest SSID. They want to use posture assessment for guests, but they are concerned about the user experience and do not want to require guests to install any software. They also want to ensure that guests with outdated browsers are redirected to a warning page. What is the best approach?

   • AUse a posture policy that checks for browser version using a web-based check (e.g., via the guest portal) and redirects non-compliant guests to a warning page.
   • BRequire guests to install the AnyConnect posture agent before accessing the internet.
   • CDo not apply posture to guests and rely on the guest portal's acceptable use policy.
   • DUse a client provisioning policy that installs a temporary agent that is removed after the session.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization uses Cisco ISE for posture assessment. When a user's endpoint is found non-compliant because the antivirus definitions are outdated, the user should be redirected to a web portal to update the antivirus, but they should still be able to access the internet for the update. After the update, the endpoint should be re-assessed and granted full access. What is the correct configuration in ISE?

   • ADefine a posture requirement for antivirus definitions, set a remediation action to redirect to a remediation portal, and apply an ACL that allows only the remediation portal and update servers during remediation.
   • BCreate a separate network access profile for non-compliant endpoints that blocks all traffic except DNS.
   • CDefine a posture requirement for antivirus definitions and set the remediation action to 'Quarantine' with no redirect.
   • DConfigure the posture policy to automatically update antivirus definitions without user interaction and grant full access immediately.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A network administrator is configuring Cisco ISE posture assessment for the first time. They have created a posture policy and assigned it to the network access profile, but endpoints are not being assessed. They have verified that the posture agent is installed and running. What is the most likely missing configuration?

   • AThe network access device is not configured to send posture attributes in RADIUS.
   • BThe endpoint's OS is not supported by the posture agent.
   • CThe posture service is not enabled on the ISE node.
   • DThe posture policy is not in the correct position in the policy set.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A university is deploying Cisco ISE for wireless network access. They want to automatically install the posture agent on student laptops when they first connect, and then enforce posture checks on subsequent connections. The students are not technical and should not be required to manually download or configure the agent. What is the best approach in ISE?

   • AProvide the agent on a USB drive to students at registration and ask them to install it manually.
   • BSkip posture assessment for the first connection and only enforce it after a week.
   • CUse client provisioning to push the posture agent profile and installer to the endpoint during the initial authentication, and configure the posture policy to require the agent for all subsequent sessions.
   • DConfigure the wireless controller to require the agent without using ISE client provisioning.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company allows employees to bring their own devices (BYOD) to the office. They want to provide network access to these devices only if they meet basic posture requirements (e.g., have a passcode enabled and a recent OS version). For non-compliant devices, they want to redirect to a self-service portal with instructions. What is the recommended way to implement this in Cisco ISE?

   • AAssign all BYOD devices to a guest portal and skip posture assessment.
   • BCreate a posture policy for BYOD devices with conditions for passcode and OS version, and set remediation to redirect to a self-service portal.
   • CUse the same posture policy as for corporate devices without any changes.
   • DBlock all BYOD devices that do not have the AnyConnect agent installed.
   Reveal Solution Discussion Select an answer first