SISE Practice Test 8 — 10 Questions

Question 1

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

Accepted Answer

The device remains Non-Compliant. If no remediation is defined, the device simply remains in a non-compliant state, and the authorization policy usually denies access or places it in a restricted VLAN.

Answer

The agent automatically remediates the issue

Answer

The device is granted full access

Answer

The posture agent crashes

Question 2

Which TWO of the following are prerequisites for the AnyConnect posture agent to function?

Accepted Answer

Connectivity to the ISE PSN. The agent needs to reach the PSN and be supported by the endpoint OS.

Answer

Administrative rights on the server

Answer

A pre-installed VPN tunnel

Answer

A static IP address on the endpoint

Question 3

You are configuring a DHCP probe on a Cisco ISE node to identify endpoints. Which specific configuration step is required to ensure the ISE node receives DHCP traffic when the client and server are on a different subnet?

Accepted Answer

Configure an IP helper-address on the Layer 3 device for the client VLAN pointing to the ISE node.. IP Helper-address must be configured on the default gateway to forward DHCP broadcasts to the ISE node acting as a probe.

Answer

Configure a DHCP relay agent on the ISE node itself.

Answer

Enable DHCP Server mode on the Cisco ISE Profiling service.

Answer

Enable DHCP Snooping on the ISE node interface.

Question 4

Which TWO of the following are potential sources of information for the DHCP probe?

Accepted Answer

DHCP Option 60 (Vendor Class Identifier). DHCP packets contain useful information in the Option fields, specifically the Vendor Class Identifier and the Parameter Request List.

Answer

Layer 2 source MAC address.

Answer

IP Header Source Address.

Answer

DHCP Option 12 (Host Name)

Question 5

Which of the following is a common reason for a 'Certificate Mismatch' error during EAP-TLS?

Accepted Answer

The client does not trust the Root CA that signed the server certificate. This occurs when the Root CA certificate on the client does not match the CA that signed the certificate provided by the ISE server.

Answer

The ISE node time is out of sync

Answer

The device is not in the correct VLAN

Answer

The SSID is not configured for EAP-TLS

Question 6

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

Accepted Answer

File Remediation Action. A File Remediation action allows you to specify a URL or a path to a file that the client can download to remediate compliance.

Answer

Post-Posture Authorization Rule

Answer

Client Provisioning Policy

Answer

Posture Requirement

Question 7

When using AnyConnect as the posture agent, how can you prevent users from disabling the posture service?

Accepted Answer

By disabling the 'Allow Stop' option in the AnyConnect profile. The AnyConnect profile (xml) can be configured to hide the UI or prevent the service from being stopped by non-admin users.

Answer

By configuring a 'Mandatory' posture requirement

Answer

By setting the 'Posture Type' to 'System'

Answer

By enabling 'Auto-Restart' in the ISE global settings

Question 8

An administrator is troubleshooting a posture failure where the AnyConnect agent is installed but ISE reports the endpoint as 'Unknown'. Which configuration setting in the Posture Policy is most likely misconfigured?

Accepted Answer

The Posture Policy is not associated with the correct Authorization Profile used in the Authorization Policy.. If the agent is installed but shows 'Unknown', it usually indicates the agent is not successfully checking in or the Posture Policy is not correctly mapped to the authorization profile currently applied to the session.

Answer

The Compliance Module is not installed on the ISE server.

Answer

The Remediation Action is disabled.

Answer

The Posture Agent configuration is missing the server discovery URL.

Answer

The ISE server certificate is not trusted by the client.

Question 9

When troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?

Accepted Answer

ISE Live Logs. The AnyConnect diagnostic logs, the ISE Posture reports, and the Live Logs are the primary sources of truth for investigating posture failures.

Answer

Cisco IOS syslog

Answer

AnyConnect VPN Gateway logs

Question 10

Which TWO of the following methods can be used to identify a device as 'BYOD' in ISE?

Accepted Answer

Bulk import of MAC addresses. Devices can be identified via manual registration by the user or through automated enrollment via the BYOD flow.

Answer

IP address range

Answer

SNMP community string

Answer

Switch port ID