4.15 pxGrid Integration Between Security Devices Cisco WSA, Cisco ISE, and Cisco FMC CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An administrator is configuring pxGrid between WSA and ISE. ISE is the broker. The administrator has enabled pxGrid on ISE and generated a certificate request on WSA. What is the next step to complete the connection?

   • AApprove the certificate request on ISE.
   • BConfigure WSA as a pxGrid broker.
   • CSubscribe WSA to the posture topic.
   • DRestart the pxGrid service on ISE.
   Reveal Solution Discussion Select an answer first
2. 42application · medium · select all that apply

   A company is integrating WSA, ISE, and FMC via pxGrid. They want to share context to improve security. Which of the following data exchanges are valid pxGrid use cases? (Select all that apply.)

   • AWSA publishes web reputation, and FMC subscribes to enhance threat correlation.
   • BISE publishes posture status, and WSA subscribes to block non-compliant devices.
   • CFMC publishes web usage data, and WSA subscribes to adjust proxy settings.
   • DFMC publishes threat events, and ISE subscribes to quarantine infected endpoints.
   • EISE publishes endpoint identity, and WSA subscribes to enforce user-based web policies.
   Check answers Discussion Select an answer first
4. 43application · medium

   A company uses Cisco WSA for web filtering and Cisco ISE for network access control. They want to enforce a policy that blocks web access for users who have a posture status of 'NonCompliant' on ISE. The integration is already configured. What must be in place for WSA to receive the posture status and enforce this policy?

   • AISE must publish to the web reputation topic on pxGrid.
   • BWSA must subscribe to the endpoint posture topic on pxGrid.
   • CWSA must be configured as the pxGrid broker.
   • DISE must subscribe to the web usage topic from WSA.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company has integrated ISE, WSA, and FMC via pxGrid. They want to enforce a policy that requires users to accept a new acceptable use policy (AUP) before accessing the internet. The policy should be triggered when a user's device posture changes to 'Compliant'. Which device should enforce this and what data does it need?

   • AISE should enforce the policy and needs to subscribe to posture changes from its own posture assessment.
   • BFMC should enforce the policy and needs to subscribe to threat events from ISE.
   • CISE should enforce the policy and needs to subscribe to web usage from WSA.
   • DWSA should enforce the policy and needs to subscribe to posture changes from ISE.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security operations team uses Cisco FMC for threat monitoring and Cisco ISE for access control. They want to automatically quarantine an endpoint when FMC detects a critical threat event. The pxGrid integration is enabled. What configuration is required on FMC to trigger the quarantine action on ISE?

   • AFMC must subscribe to the endpoint identity topic from ISE to learn which endpoint to quarantine.
   • BFMC must publish threat events to the pxGrid threat topic, and ISE must subscribe to that topic.
   • CISE must publish threat events to the pxGrid threat topic, and FMC must subscribe to that topic.
   • DISE must be configured as the pxGrid broker and FMC as the publisher of endpoint identity.
   Reveal Solution Discussion Select an answer first