4.15 pxGrid Integration Between Security Devices Cisco WSA, Cisco ISE, and Cisco FMC CCIE-SECURITY Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A network engineer has configured pxGrid between Cisco ISE and Cisco WSA. The integration is not working; WSA is not receiving endpoint identity updates. The engineer has verified that both devices are reachable and certificates are trusted. What should the engineer check next?

   • AEnsure that WSA is configured as the pxGrid broker.
   • BRestart the WSA proxy service.
   • CVerify that WSA has subscribed to the endpoint identity topic on ISE.
   • DCheck if the ISE pxGrid service is running on port 5222.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A large enterprise is deploying pxGrid across multiple sites. They have two ISE deployments (primary and secondary) and want to ensure high availability for pxGrid. The requirement is that if the primary ISE fails, WSA and FMC should continue to receive updates without manual intervention. What is the best approach?

   • AConfigure both ISE nodes as pxGrid brokers and have WSA/FMC connect to both.
   • BUse a load balancer in front of the ISE nodes for pxGrid traffic.
   • CSet up a separate pxGrid broker on a virtual machine independent of ISE.
   • DConfigure WSA and FMC to use the secondary ISE only as a fallback via DNS.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security architect is designing a new pxGrid deployment for a multi-vendor environment. The team needs to ensure that all security devices can share real-time context without a single point of failure. The architect decides to deploy multiple pxGrid controllers. Which role must these controllers assume in the pxGrid architecture to support this design?

   • ABroker
   • BCertificate Authority
   • CSubscriber
   • DPublisher
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has integrated WSA and ISE via pxGrid. They want to enforce different web policies based on user identity and device posture. Currently, WSA is receiving identity information but not posture. The ISE policy is set to evaluate posture, but WSA still does not see posture status. What is the most likely reason?

   • AWSA is not configured as a pxGrid publisher.
   • BWSA is subscribed to the identity topic but not the posture topic.
   • CThe pxGrid certificate on WSA is invalid.
   • DISE is not publishing posture data because the endpoint is not posture-compliant.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team has integrated ISE and FMC via pxGrid. They want to automatically block an endpoint when FMC detects a threat. The integration is working, but the blocking action is not being applied. The team has verified that FMC is publishing threat events and ISE is subscribed. What should they check next?

   • AVerify that the ISE authorization policy has an action to block the endpoint.
   • BEnsure that WSA is also subscribed to the threat topic.
   • CCheck if FMC is configured as the pxGrid broker.
   • DReboot the FMC to refresh the pxGrid connection.
   Reveal Solution Discussion Select an answer first