4.15 pxGrid Integration Between Security Devices Cisco WSA, Cisco ISE, and Cisco FMC CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the first step in configuring a pxGrid connection between Cisco ISE and another device like WSA or FMC?

   • ACreate a new user account on the remote device
   • BEnable pxGrid on the ISE node
   • CSubscribe to relevant topics
   • DConfigure the broker on the remote device
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security architect is designing a pxGrid deployment for a multi-vendor environment. The requirement is to ensure that Cisco ISE can share endpoint identity and posture information with both Cisco WSA and Cisco FMC, while also allowing WSA to publish web reputation data that FMC can consume. The architect needs to identify the correct role for each device in the pxGrid topology. Which role assignment is correct?

   • AISE acts as the broker, WSA and FMC are subscribers only.
   • BWSA acts as the broker, ISE publishes endpoint identity, FMC subscribes to web reputation.
   • CISE acts as the broker, WSA publishes web reputation, FMC subscribes to web reputation and endpoint context.
   • DFMC acts as the broker, ISE and WSA are publishers only.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team has integrated Cisco WSA and ISE via pxGrid. They notice that WSA is not enforcing web policies based on posture changes in real-time; there is a delay of several minutes. The team suspects a configuration issue. What is the most likely cause?

   • AISE is configured to publish posture updates only every 5 minutes.
   • BThe pxGrid certificate has expired, causing intermittent failures.
   • CWSA is polling ISE for posture updates instead of subscribing to the posture topic.
   • DWSA is using a different pxGrid topic for posture than ISE is publishing.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security operations center uses Cisco ISE and FMC via pxGrid. They want to automatically quarantine endpoints that are involved in a C2 callback detected by FMC. However, they are concerned about false positives and want to require that the endpoint also has a low posture score before quarantine. How can this be achieved?

   • AUse WSA to block the C2 traffic and rely on that as the quarantine.
   • BConfigure ISE to subscribe to both threat events and posture topics, then use an ISE policy that requires both conditions.
   • CConfigure FMC to check posture before publishing the threat event.
   • DSet up a syslog-based correlation engine to combine logs from ISE and FMC.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An organization has Cisco WSA and FMC integrated via pxGrid. They want to block access to malicious websites based on real-time web reputation from WSA. However, they are concerned about performance impact on FMC's IPS. What is the best way to use the web reputation data without overwhelming FMC?

   • AConfigure WSA to block malicious sites and only send alerts to FMC.
   • BHave FMC subscribe to the web reputation topic and use it only for high-risk categories.
   • CDisable web reputation on FMC and rely on WSA's blocking.
   • DUse a separate pxGrid topic for each reputation score to reduce data volume.
   Reveal Solution Discussion Select an answer first