4.15 pxGrid Integration Between Security Devices Cisco WSA, Cisco ISE, and Cisco FMC CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A network engineer is configuring pxGrid between Cisco ISE and FMC. The engineer has enabled pxGrid on ISE and generated a certificate, but the certificate is self-signed. The security policy requires the use of a CA-signed certificate for all integrations. What should the engineer do?

   • AUse a pre-shared key instead of certificates.
   • BGenerate a CA-signed certificate on ISE and upload it to FMC as the trusted certificate.
   • CDisable certificate validation on FMC for pxGrid.
   • DUse the self-signed certificate and accept the risk.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard · select all that apply

   A security architect is designing a pxGrid deployment and needs to ensure that each device publishes and subscribes to the appropriate topics. The architect wants to avoid unnecessary data flow. Which of the following topic assignments are correct? (Select all that apply.)

   • AISE publishes endpoint identity; WSA subscribes to endpoint identity.
   • BWSA publishes endpoint posture; ISE subscribes to endpoint posture.
   • CFMC publishes web reputation; WSA subscribes to web reputation.
   • DWSA publishes web reputation; FMC subscribes to web reputation.
   • EFMC publishes threat events; ISE subscribes to threat events.
   Check answers Discussion Select an answer first
4. 23expert · hard

   A company has a security policy that requires users to be authenticated before accessing the internet, but only if their device is compliant. They have Cisco ISE and WSA. The current setup uses WSA's transparent proxy, and users are authenticated via Active Directory. The company wants to use pxGrid to enforce this policy. What is the best way to implement this?

   • ASet up a RADIUS server on WSA to query ISE for posture.
   • BUse ISE to share posture status with WSA via pxGrid, and configure WSA to require authentication only for non-compliant devices.
   • CConfigure WSA to always authenticate users and ignore posture.
   • DUse FMC to enforce authentication based on threat intelligence.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A network administrator is troubleshooting a pxGrid integration between Cisco ISE and FMC. The connection is established, but FMC is not receiving threat events. The administrator has verified that FMC is subscribed to the correct topic and certificates are valid. What should the administrator check next?

   • ARestart the pxGrid service on ISE.
   • BCheck if the FMC firewall is blocking port 5222.
   • CCheck if the threat events are being generated on FMC and published to pxGrid.
   • DVerify that FMC is using the correct pxGrid broker IP address.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company wants to enforce web usage policies based on user identity and device posture. They have Cisco WSA and Cisco ISE. The requirement is that when a user's device fails posture assessment, WSA should block access to sensitive web categories. What is the most efficient way to achieve this using pxGrid?

   • AUse WSA's local user database to manually assign posture levels.
   • BConfigure WSA to query ISE via RADIUS for each web request.
   • CEnable pxGrid on ISE and WSA, then have WSA subscribe to the endpoint posture topic and enforce policy based on posture status.
   • DConfigure ISE to send syslog messages to WSA for each posture change.
   Reveal Solution Discussion Select an answer first