SISE Practice Test 6 — 10 Questions

Question 1

Which AnyConnect module is specifically required to perform posture assessment in ISE?

Accepted Answer

AnyConnect Compliance Module. The 'AnyConnect Compliance Module' (formerly known as the posture module) is required.

Answer

AnyConnect AMP Enabler

Answer

AnyConnect Web Security Module

Answer

AnyConnect VPN Module

Question 2

Which THREE conditions are required for successful AnyConnect posture assessment in a wired network environment?

Accepted Answer

The endpoint must have the AnyConnect agent installed.. Posture requires a working authorization profile, a properly provisioned agent, and a clear communication path between the agent and the ISE Policy Services Node (PSN).

Answer

The switch must be configured for WebAuth.

Answer

The endpoint must be joined to an Active Directory domain.

Question 3

Which protocol is used by ISE to communicate with the MDM server for device status checks?

Accepted Answer

REST API. ISE uses REST APIs to communicate with most modern MDM solutions like AirWatch or Intune.

Answer

SNMP

Answer

RADIUS

Answer

LDAP

Question 4

A user is unable to pass posture assessment because the 'AnyConnect Compliance Module' is not detecting the antivirus software. Which log file on the endpoint should be reviewed to troubleshoot the compliance module's scanning logic?

Accepted Answer

AnyConnect Compliance Module log (ac_ise_posture.log). The ACLog.txt or the Compliance Module logs (typically found in %ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\ISE Posture) contain details about scan results.

Answer

NAC Agent Log (nac_agent.log)

Answer

Windows Event Viewer - Application Log

Answer

ISE Posture Log (ise_posture.log)

Question 5

When configuring an 'Application Condition' to check for a specific version of an application, which operator is required to ensure the version is at least '10.5.0'?

Accepted Answer

Greater Than or Equal. The 'Greater Than or Equal' operator is necessary to ensure the version meets or exceeds the security requirement.

Answer

Matches

Answer

Equals

Answer

Contains

Question 6

What is the effect of setting a Posture Requirement to 'Optional'?

Accepted Answer

The user can choose to bypass the check without being blocked. Optional means the agent will perform the check, but if the endpoint is non-compliant, the access is not restricted based on that specific requirement.

Answer

The agent only checks when requested by the user

Answer

The agent will not perform the check at all

Answer

The device is automatically granted access

Question 7

You are configuring a 'Registry' check as part of a posture requirement. The goal is to ensure a specific registry key exists to prove a corporate application is configured correctly. What is the correct way to specify the path if the key is located in HKEY_LOCAL_MACHINE?

Accepted Answer

Use 'HKLM' as the root of the path.. In Cisco ISE posture requirement configurations, you must use the 'HKLM' abbreviation for the HKEY_LOCAL_MACHINE root key when defining the path.

Answer

Use 'ROOT:HKLM'.

Answer

The path must be relative to the user profile, so HKLM is invalid.

Answer

Use a backslash prefix like '\HKLM'.

Answer

Use the full string 'HKEY_LOCAL_MACHINE' at the start of the path.

Question 8

Which THREE of the following are valid remediation actions?

Accepted Answer

Service Remediation. File, Registry, and Service remediation are standard in Cisco ISE.

Answer

VLAN Remediation

Answer

ACL Remediation

Question 9

Which component of the BYOD flow identifies the device type (e.g., iPhone vs. Windows) for appropriate configuration?

Accepted Answer

Device Profiling. ISE uses 'Device Profiling' (via DHCP fingerprinting, HTTP User-Agent, etc.) to identify the device and trigger the correct provisioning flow.

Answer

RADIUS Accounting

Answer

Active Directory Identity Store

Answer

Policy Sets

Question 10

You need to ensure that different network devices trigger different authorization policies based on their location. What is the best way to group these devices for policy conditions?

Accepted Answer

By creating a Network Device Group. Network Device Groups (NDGs) allow you to logically group devices and use them in policy conditions.

Answer

By using IP address ranges in the policy

Answer

By tagging them with SGTs

Answer

By using the Device Name in the condition