SISE Endpoint Compliance — 25 Questions

Question 1

A user is unable to pass posture assessment because the 'AnyConnect Compliance Module' is not detecting the antivirus software. Which log file on the endpoint should be reviewed to troubleshoot the compliance module's scanning logic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AnyConnect Compliance Module log (ac_ise_posture.log). The ACLog.txt or the Compliance Module logs (typically found in %ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\ISE Posture) contain details about scan results.

Answer

NAC Agent Log (nac_agent.log)

Answer

Windows Event Viewer - Application Log

Answer

ISE Posture Log (ise_posture.log)

Question 2

What is the primary function of the 'Monitor Mode' in Cisco ISE Posture policies?

Accepted Answer

To gather compliance data without restricting network access. Monitor Mode allows administrators to log posture results without denying access, facilitating testing before enforcement.

Answer

To automatically remediate endpoints

Answer

To bypass the posture check entirely

Answer

To block all traffic until the agent is installed

Question 3

When configuring an AnyConnect Posture Policy, which option allows the administrator to force the agent to perform a scan regardless of the current posture status?

Accepted Answer

Agent Enforcement set to 'Mandatory'. The 'Mandatory' setting in the Posture Requirement forces the agent to report status and remediate if necessary, whereas 'Optional' allows the user to skip.

Answer

Posture Type set to 'Continuos'

Answer

Policy Status set to 'Production'

Question 4

Which protocol is used by the AnyConnect agent to communicate posture information to the ISE Policy Service Node (PSN)?

Accepted Answer

HTTP/HTTPS (TCP 8905). ISE posture agents use HTTPS (TCP 8905) for communication with the PSN.

Answer

RADIUS

Answer

DNS

Answer

SNMP

Question 5

Where do you upload the AnyConnect posture agent packages to make them available for Client Provisioning?

Accepted Answer

Policy > Policy Elements > Results > Client Provisioning > Resources. Client Provisioning resources are managed under Policy > Policy Elements > Results > Client Provisioning > Resources.

Answer

Operations > Troubleshoot > Client Provisioning

Answer

Policy > Posture > Policy

Answer

Administration > System > Settings > Posture

Question 6

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

Accepted Answer

File Remediation Action. A File Remediation action allows you to specify a URL or a path to a file that the client can download to remediate compliance.

Answer

Post-Posture Authorization Rule

Answer

Client Provisioning Policy

Answer

Posture Requirement

Question 7

You need to create a posture condition to verify that the 'Cisco AnyConnect' service is running. Which condition type should you select?

Accepted Answer

Service Condition. Service conditions are used to verify that specific Windows services or macOS processes are active.

Answer

Registry Condition

Answer

Process Condition

Answer

Application Condition

Question 8

An administrator needs to ensure that only endpoints with a specific registry key present are allowed access. Where should this posture condition be defined in Cisco ISE?

Accepted Answer

Policy > Policy Elements > Conditions > Posture > Registry Condition. Registry checks are configured under Policy > Policy Elements > Conditions > Posture > Registry Condition.

Answer

Administration > System > Settings > Posture

Answer

Policy > Policy Elements > Conditions > Authorization > Compound Condition

Answer

Policy > Policy Elements > Results > Posture > Remediation Actions

Question 9

Which of the following is a valid remediation action type in Cisco ISE?

Accepted Answer

File Remediation. File, Registry, and Service remediation are standard options.

Answer

Process Kill Remediation

Answer

Network Remediation

Answer

User Prompt Remediation

Question 10

Which component is responsible for triggering the posture assessment process when a user connects to the network?

Accepted Answer

Posture Policy. The posture requirement, when associated with a client provisioning policy, triggers the AnyConnect agent to begin assessment.

Answer

Network Access Device (NAD)

Answer

AnyConnect Compliance Module

Answer

RADIUS Server

Question 11

When configuring an 'Application Condition' to check for a specific version of an application, which operator is required to ensure the version is at least '10.5.0'?

Accepted Answer

Greater Than or Equal. The 'Greater Than or Equal' operator is necessary to ensure the version meets or exceeds the security requirement.

Answer

Matches

Answer

Equals

Answer

Contains

Question 12

Which menu path allows you to view the posture compliance status of all endpoints?

Accepted Answer

Context Visibility > Endpoints. Operations > Reports > Endpoints and Users > Posture Assessment is the standard path to view posture-specific reports.

Answer

Administration > Identity Management

Answer

Policy > Posture > Reports

Question 13

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

Accepted Answer

The device remains Non-Compliant. If no remediation is defined, the device simply remains in a non-compliant state, and the authorization policy usually denies access or places it in a restricted VLAN.

Answer

The agent automatically remediates the issue

Answer

The device is granted full access

Answer

The posture agent crashes

Question 14

You need to ensure that the AnyConnect posture agent is updated automatically. Where is this configured?

Accepted Answer

Client Provisioning Policy. The 'Agent Lifecycle' or 'Client Provisioning' settings allow you to define versioning and update requirements.

Answer

Posture Policy > Settings

Answer

Posture Requirements

Answer

Remediation Actions

Question 15

A user is compliant, but ISE still classifies the device as 'Unknown'. What is the most likely cause?

Accepted Answer

The posture agent failed to connect to the PSN. If the device is 'Unknown', it means the posture agent has not successfully sent the report to the PSN or the PSN has not updated the session state.

Answer

The Client Provisioning policy is misconfigured

Answer

The remediation action is disabled

Answer

The authorization rule is incorrect

Question 16

When using AnyConnect as the posture agent, how can you prevent users from disabling the posture service?

Accepted Answer

By disabling the 'Allow Stop' option in the AnyConnect profile. The AnyConnect profile (xml) can be configured to hide the UI or prevent the service from being stopped by non-admin users.

Answer

By configuring a 'Mandatory' posture requirement

Answer

By setting the 'Posture Type' to 'System'

Answer

By enabling 'Auto-Restart' in the ISE global settings

Question 17

During a troubleshooting session, you notice that the AnyConnect agent is not receiving the posture policy. Which log file on the ISE Policy Service Node (PSN) should you examine?

Accepted Answer

ise-psc.log. The 'ise-psc.log' (Policy Service Component) is the primary log for posture policy evaluation and agent communication.

Answer

prrt-server.log

Answer

guest.log

Answer

admin.log

Question 18

Which of the following is required for AnyConnect to perform posture assessment on a Mac endpoint?

Accepted Answer

The 'AnyConnect Compliance Module' must be installed. The 'AnyConnect Compliance Module' must be deployed and configured to support macOS.

Answer

The Mac must be domain joined

Answer

A separate 'Posture Proxy' must be configured

Answer

The user must have root access

Question 19

What is the purpose of the 'Posture Discovery' phase?

Accepted Answer

To identify if posture is required for the session. Discovery is the initial communication where the agent identifies the ISE PSN and checks if a posture policy exists.

Answer

To verify the user credentials

Answer

To remediate non-compliant endpoints

Answer

To determine if the endpoint is compliant

Question 20

Which posture condition should be used to ensure a specific Windows patch (KB number) is installed?

Accepted Answer

Patch Condition. A 'Patch Condition' is used specifically to verify the presence of Windows updates/patches.

Answer

Registry Condition

Answer

Application Condition

Answer

File Condition