A company needs to deploy different AnyConnect client profiles to different user groups. For example, the Engineering group should have the 'Enable Automatic VPN' feature enabled, while the Sales group should not. They are using ISE for policy management. What is the most scalable way to achieve this?

Create two different client profiles in ISE and use authorization policies to assign the correct profile to each user group.

Create two different client profiles on the ASA and assign them to different tunnel-groups.

Create a single client profile on the ASA that includes both configurations and let the users choose which one to use.

Create a single client profile in ISE and use a posture policy to modify the profile on the endpoint.

An administrator wants to host the AnyConnect client profile on the ASA so that it is automatically downloaded and applied when a user connects. What is the correct way to configure this on the ASA?

Use the 'crypto isakmp' configuration mode and the 'client profile' command to specify the profile file.

Use the 'webvpn' configuration mode and the 'anyconnect profiles' command to specify the profile file.

Use the 'interface' configuration mode and the 'profile' command to specify the profile file.

Use the 'aaa-server' configuration mode and the 'profile' command to specify the profile file.

A small company is setting up remote access VPN for the first time. They have a single ASA and want to use ISE for centralized policy management. They are unsure about the roles of each device in the AnyConnect provisioning workflow. Which statement correctly describes the roles of ISE and ASA?

The ASA is the policy decision point, and ISE is the enforcement point.

ISE is the enforcement point, and the ASA is the policy decision point.

ISE is the policy decision point, and the ASA is the enforcement point.

Both ISE and ASA are policy decision points, and the client is the enforcement point.

A user reports that they can successfully authenticate to the ASA and download the AnyConnect client, but they cannot establish a full VPN tunnel. The ASA logs show that the user is authenticated but is being placed in a restricted access state. What is the most likely cause?

The user's posture assessment is failing, and ISE is returning a 'Non-Compliant' authorization result.

The ASA is configured with the wrong AnyConnect image version.

The user's RADIUS authentication is failing, and they are being placed in a guest VLAN.

The AnyConnect client profile is not configured correctly on the ASA.

An administrator is configuring ISE for AnyConnect provisioning. They want to ensure that only users from the 'VPN-Users' Active Directory group are allowed to authenticate. What is the first step they must take in ISE to achieve this?

Configure an identity source sequence that includes the Active Directory group.

Create an authorization policy that matches the 'VPN-Users' group and returns a permit access result.

Create a client profile in ISE that specifies the 'VPN-Users' group.

Configure the ASA to send the 'VPN-Users' group name in the RADIUS request.

CCIE Security

Domain 4Objective 8

4.8 Provisioning Cisco AnyConnect with Cisco ISE and Cisco ASA CCIE-SECURITY Practice Questions (Page 5)

Part of the 4.0 Identity Management, Information Exchange, and Access Control domain, which accounts for 25% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–1 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

8concepts

25%of the exam

Questions 21–25

21application · medium
A company needs to deploy different AnyConnect client profiles to different user groups. For example, the Engineering group should have the 'Enable Automatic VPN' feature enabled, while the Sales group should not. They are using ISE for policy management. What is the most scalable way to achieve this?
Select an answer first
22application · easy
An administrator wants to host the AnyConnect client profile on the ASA so that it is automatically downloaded and applied when a user connects. What is the correct way to configure this on the ASA?
Select an answer first
23application · easy
A small company is setting up remote access VPN for the first time. They have a single ASA and want to use ISE for centralized policy management. They are unsure about the roles of each device in the AnyConnect provisioning workflow. Which statement correctly describes the roles of ISE and ASA?
Select an answer first
24application · medium
A user reports that they can successfully authenticate to the ASA and download the AnyConnect client, but they cannot establish a full VPN tunnel. The ASA logs show that the user is authenticated but is being placed in a restricted access state. What is the most likely cause?
Select an answer first
25application · medium
An administrator is configuring ISE for AnyConnect provisioning. They want to ensure that only users from the 'VPN-Users' Active Directory group are allowed to authenticate. What is the first step they must take in ISE to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.