4.9 Posture Assessment with Cisco ISE CCIE-SECURITY Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company is deploying Cisco ISE posture assessment for their Windows 10 endpoints. They want to ensure that only endpoints with the latest Windows updates and a running antivirus are granted full network access. The security team wants a solution that requires minimal user interaction and automatically enforces compliance. What should the administrator configure in Cisco ISE to meet these requirements?

   • AUse client provisioning to push a posture agent profile that automatically updates Windows and antivirus.
   • BCreate a posture policy with conditions for Windows updates and antivirus, and assign it to the appropriate network access profile.
   • CDeploy the AnyConnect posture agent to all endpoints and configure it to report compliance status to ISE.
   • DEnable posture assessment globally and set the default posture policy to 'Compliant' for all endpoints.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An organization has a posture policy that requires endpoints to have the latest antivirus definitions. When an endpoint is non-compliant, ISE redirects the user to a remediation portal. However, the user reports that after updating the antivirus, they are still redirected to the portal. What should the administrator check first?

   • AEnsure that the remediation portal is accessible from the endpoint.
   • BConfirm that the antivirus definitions are actually updated on the endpoint.
   • CCheck the ISE logs to see if the posture assessment is failing.
   • DVerify that the posture agent is re-assessing the endpoint after the remediation.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company uses Cisco ISE to enforce posture compliance for Windows and Mac endpoints. They want to check that the Windows firewall is enabled and that the Mac has FileVault enabled. What is the best way to configure these checks in ISE?

   • ACreate separate posture conditions for Windows and Mac, and include them in the appropriate posture policy.
   • BCreate a single posture condition that checks for both firewall and FileVault.
   • CUse client provisioning to install the same agent on both platforms and rely on the agent to check both.
   • DConfigure a remediation action that enables the firewall and FileVault.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A network administrator is troubleshooting why a specific Windows endpoint is not being assessed by Cisco ISE. The endpoint is able to authenticate and receive an IP address, but the posture assessment never starts. The administrator has verified that the posture policy is correctly assigned and the endpoint is in the correct authorization profile. What is the most likely cause?

   • AThe AnyConnect posture agent is not installed or is not running on the endpoint.
   • BThe endpoint's firewall is blocking communication with ISE.
   • CThe network access profile is not configured to require posture assessment.
   • DThe endpoint is running a macOS version that is not supported.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company has a posture policy that requires all endpoints to have the latest OS patches. However, some endpoints are running an older OS version that is no longer supported by the posture agent. The security team wants to allow these endpoints to access the network but with limited access, while still encouraging them to upgrade. What is the best approach in Cisco ISE?

   • AUse client provisioning to force an OS upgrade on the endpoint.
   • BIgnore the OS version and only check for antivirus.
   • CBlock all access for unsupported OS versions until they are upgraded.
   • DCreate a separate posture policy for unsupported OS versions that grants limited access and includes a remediation message to upgrade.
   Reveal Solution Discussion Select an answer first