After deploying Cisco ISE posture assessment, the security team notices that some endpoints are not being assessed at all. They want to identify which endpoints are failing to run the posture agent and why. Which ISE feature should they use to get this information?

Review the network access device logs for posture-related messages.

Check the RADIUS live logs to see authentication attempts and posture status.

Use the Posture Assessment report in ISE to view compliance status and failure reasons for each endpoint.

Run a packet capture on the endpoint to see if the agent is sending posture information.

A hospital uses Cisco ISE for network access control. They have two groups of users: doctors who use hospital-owned Windows laptops and nurses who use personal iPads. The hospital wants to enforce different posture requirements: doctors must have antivirus running and the latest patches, while nurses only need a passcode and a recent iOS version. What is the most efficient way to configure this in ISE?

Create a single posture policy and assign it to the network access profile, then use authorization profiles to filter.

Use the default posture policy and modify the conditions to be optional.

Create one posture policy with conditions that apply to all devices, but include both antivirus and passcode checks.

Create two separate posture policies, each assigned to the appropriate user group or endpoint identity group, with specific conditions for each device type.

A company is rolling out Cisco ISE posture assessment for their remote access VPN. They want to use the AnyConnect posture agent, but they need to ensure that the agent is updated automatically when a new version is released. They also want to minimize user interaction. What should they configure in ISE?

Rely on the VPN gateway to update the agent during connection.

Configure the AnyConnect posture agent profile in ISE to enable automatic updates and use client provisioning to deliver the profile to endpoints.

Use the posture policy to require a minimum agent version and block endpoints that do not meet it.

Manually install the latest agent on each endpoint and disable updates.

An organization wants to enforce that all Windows 10 endpoints have a specific security patch installed. They are using Cisco ISE posture assessment. How should they define this requirement in ISE?

Use the built-in 'Windows Update' condition and set the required patch level to 'Latest'.

Create a posture requirement that runs a script to install the patch if missing.

Configure the posture policy to allow all Windows 10 endpoints and rely on the OS to enforce the patch.

Create a posture condition that checks for the presence of the specific patch using a registry key or file version, and add it to the posture policy.

A company uses Cisco ISE for posture assessment. They have a posture policy that requires antivirus software to be running. When an endpoint is non-compliant, they want to give the user a grace period of 10 minutes to fix the issue before restricting access. How can they achieve this?

Set the posture policy to 'Monitor' mode so that non-compliant endpoints are not restricted.

Configure the network access device to delay the posture check by 10 minutes.

Configure a remediation action that allows the endpoint to remain on the network for a specified time before applying a restrictive ACL.

Use a CoA (Change of Authorization) to re-authenticate the endpoint after 10 minutes.

CCIE Security

Domain 4Objective 9

4.9 Posture Assessment with Cisco ISE CCIE-SECURITY Practice Questions (Page 7)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

25%of the exam

Questions 31–35

31application · medium
After deploying Cisco ISE posture assessment, the security team notices that some endpoints are not being assessed at all. They want to identify which endpoints are failing to run the posture agent and why. Which ISE feature should they use to get this information?
Select an answer first
32application · medium
A hospital uses Cisco ISE for network access control. They have two groups of users: doctors who use hospital-owned Windows laptops and nurses who use personal iPads. The hospital wants to enforce different posture requirements: doctors must have antivirus running and the latest patches, while nurses only need a passcode and a recent iOS version. What is the most efficient way to configure this in ISE?
Select an answer first
33application · medium
A company is rolling out Cisco ISE posture assessment for their remote access VPN. They want to use the AnyConnect posture agent, but they need to ensure that the agent is updated automatically when a new version is released. They also want to minimize user interaction. What should they configure in ISE?
Select an answer first
34application · medium
An organization wants to enforce that all Windows 10 endpoints have a specific security patch installed. They are using Cisco ISE posture assessment. How should they define this requirement in ISE?
Select an answer first
35application · medium
A company uses Cisco ISE for posture assessment. They have a posture policy that requires antivirus software to be running. When an endpoint is non-compliant, they want to give the user a grace period of 10 minutes to fix the issue before restricting access. How can they achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

4.9 Posture Assessment with Cisco ISE CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

After deploying Cisco ISE posture assessment, the security team notices that some endpoints are not being assessed at all. They want to identify which endpoints are failing to run the posture agent and why. Which ISE feature should they use to get this information?

An organization wants to enforce that all Windows 10 endpoints have a specific security patch installed. They are using Cisco ISE posture assessment. How should they define this requirement in ISE?

A company uses Cisco ISE for posture assessment. They have a posture policy that requires antivirus software to be running. When an endpoint is non-compliant, they want to give the user a grace period of 10 minutes to fix the issue before restricting access. How can they achieve this?

Keep studying — 4.0 Identity Management, Information Exchange, and Access Control