SISE Endpoint Compliance Practice Test 2 — 15 Questions

Question 1

Which THREE conditions are required for successful AnyConnect posture assessment in a wired network environment?

Accepted Answer

The endpoint must have the AnyConnect agent installed.. Option B is correct because successful posture assessment requires the AnyConnect agent (with the ISE Posture module) to be installed on the endpoint, since it is the agent that performs the posture checks and communicates with ISE. Option C is correct because the Client Provisioning service on the ISE PSN is responsible for delivering the posture policy, agent provisioning, and compliance modules to the endpoint during the posture flow. Option D is correct because an Authorization Profile configured for posture redirection (using a redirect ACL and URL) is needed to steer the endpoint into the posture process before full network access is granted. Option A is incorrect because WebAuth is a web authentication method for guest or BYOD flows, not a requirement for posture assessment in a wired environment. Option E is incorrect because Active Directory domain membership is not required for posture assessment; posture can be evaluated for non-domain endpoints as well.

Answer

The switch must be configured for WebAuth.

Answer

The endpoint must be joined to an Active Directory domain.

Question 2

An administrator has configured a posture policy that requires Windows endpoints to have the latest Windows Defender definitions. A user reports that after connecting, the AnyConnect posture agent shows a non-compliant status, but the user is not automatically redirected to a remediation portal. The administrator confirms that the posture policy is correctly assigned and the agent is installed. What is the most likely reason the user is not being redirected?

Accepted Answer

The posture policy is set to 'Audit' mode instead of 'Enforce' mode.. The posture policy's enforcement mode determines whether ISE redirects non-compliant endpoints to a remediation portal. In Audit mode, ISE only monitors and logs compliance without enforcing. The user sees the non-compliant status but is not redirected. Changing the mode to Enforce activates the configured remediation actions, including redirection.

Answer

The Windows Defender definitions are not included in the posture condition.

Answer

The remediation action is not configured to 'Auto Remediate'.

Answer

The AnyConnect posture agent is not configured to allow redirection.

Question 3

A network administrator is deploying posture assessment for a group of corporate-owned macOS endpoints. The administrator wants to ensure that the endpoints are checked for specific security requirements before being granted full network access. The administrator has already installed the AnyConnect posture agent and configured the necessary conditions. Which two additional components are required to complete the posture configuration? (Choose two.)

Accepted Answer

Posture policy. To enable posture assessment, ISE requires a posture policy that defines the checks and a client provisioning policy that specifies which posture agent to provision. The posture policy evaluates conditions and determines compliance, while the client provisioning policy ensures the agent is installed and configured correctly. Other policies like authorization and profiling are important for overall network access control but are not part of the core posture configuration.

Answer

Remediation policy

Answer

Profiling policy

Answer

Authorization policy

Question 4

A security engineer is configuring posture remediation for Windows endpoints. When an endpoint fails a posture check for missing antivirus definitions, the engineer wants to automatically trigger a definition update without user interaction. The engineer configures a remediation action of type 'Windows Server Update Services (WSUS)' and associates it with the posture policy. However, after testing, the remediation does not start. What is the most likely reason?

Accepted Answer

The WSUS remediation action requires that the endpoint be a member of an Active Directory domain and have the WSUS client configured to use the specified WSUS server.. The WSUS remediation action requires the endpoint to be domain-joined and configured to use the specified WSUS server. Without this, the Windows Update Agent cannot locate the WSUS server, and remediation fails. The other options are either incorrect platform assumptions or would result in different symptoms, such as no posture assessment at all.

Answer

The remediation action is not supported on Windows endpoints; it is only available for macOS and Linux.

Answer

The posture policy is set to 'Audit' mode, which prevents remediation actions from executing.

Answer

The remediation action requires the AnyConnect posture module to be installed and running, but it is not.

Question 5

An administrator is troubleshooting a posture issue where a Windows endpoint is marked as Non-Compliant for a check that verifies the presence of a specific service. The AnyConnect Posture module is installed and running. The administrator runs the AnyConnect Diagnostics and Reporting Tool (DART) and sees that the service check returned a value of 'Not Found', but the service is actually running on the endpoint. What is the most likely cause of this discrepancy?

Accepted Answer

The service name in the posture condition is case-sensitive and does not match the actual service name.. Posture conditions that check for Windows services compare the specified service name against the actual service name. If the condition uses a service name with different casing than the actual service, and the comparison is case-sensitive, the check will fail even though the service is running. Ensuring the service name matches exactly, including case, resolves the issue.

Answer

The service is set to start manually and is not currently running, so the posture check correctly reports it as not found.

Answer

The AnyConnect Posture module does not have sufficient permissions to query the service status.

Answer

The posture condition is configured to check for a process instead of a service, causing a mismatch.

Question 6

An administrator is configuring posture policy requirements for macOS endpoints using Cisco AnyConnect. The goal is to ensure that endpoints have a specific antivirus application installed and running, and that the operating system is up to date. Which two posture condition types are required to achieve these checks? (Choose two.)

Accepted Answer

Application condition. To verify that an antivirus application is installed and running on macOS, the administrator needs an Application condition to detect the installed application and a Process condition to confirm the application's process is active. The OS update requirement would be handled separately, often with a File or Script condition, but the question specifically asks for the two condition types required for the antivirus checks.

Answer

OS Update condition

Answer

Registry condition

Answer

File condition

Question 7

What is the primary function of the 'Monitor Mode' in Cisco ISE Posture policies?

Accepted Answer

To gather compliance data without restricting network access. In Cisco ISE Posture policies, Monitor Mode is used to assess endpoint compliance without restricting network access. The endpoint is allowed on the network, but posture data is collected and logged. This allows administrators to see compliance status without impacting users, making option A correct.

Answer

To automatically remediate endpoints

Answer

To bypass the posture check entirely

Answer

To block all traffic until the agent is installed

Question 8

Which protocol is used by the AnyConnect agent to communicate posture information to the ISE Policy Service Node (PSN)?

Accepted Answer

HTTP/HTTPS (TCP 8905). The AnyConnect (now Secure Client) posture module communicates with the ISE Policy Service Node over HTTPS on TCP port 8905, using the ISE posture agent protocol. RADIUS is used only for the initial 802.1X/MAB authentication and authorization, not for ongoing posture data exchange. The posture agent sends posture assessment results (AVC, AS, etc.) to the PSN via this HTTPS channel, and the PSN returns the compliance decision.

Answer

RADIUS

Answer

DNS

Answer

SNMP

Question 9

Where do you upload the AnyConnect posture agent packages to make them available for Client Provisioning?

Accepted Answer

Policy > Policy Elements > Results > Client Provisioning > Resources. AnyConnect posture agent packages are uploaded in ISE under Policy > Policy Elements > Results > Client Provisioning > Resources. This is where administrators add agent resources (such as AnyConnect .pkg or .msi files) and compliance modules, which are then referenced by Client Provisioning policies to be pushed to endpoints.

Answer

Operations > Troubleshoot > Client Provisioning

Answer

Policy > Posture > Policy

Answer

Administration > System > Settings > Posture

Question 10

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

Accepted Answer

File Remediation Action. A File Remediation Action in Cisco ISE is specifically designed to provide users with a downloadable link or instructions to obtain the required compliance software when a posture check fails. It is the remediation component that bridges the gap between a failed posture condition and the user's ability to fix it.

Answer

Post-Posture Authorization Rule

Answer

Client Provisioning Policy

Answer

Posture Requirement

Question 11

You need to create a posture condition to verify that the 'Cisco AnyConnect' service is running. Which condition type should you select?

Accepted Answer

Service Condition. In Cisco ISE posture conditions, a Service Condition is used to check whether a specific service (such as the Cisco AnyConnect service) is running on the endpoint. This condition type queries the endpoint's service status via the posture agent and returns a compliant or non-compliant result based on whether the service is active. It is the correct choice for verifying that a named service is running.

Answer

Registry Condition

Answer

Process Condition

Answer

Application Condition

Question 12

An administrator needs to ensure that only endpoints with a specific registry key present are allowed access. Where should this posture condition be defined in Cisco ISE?

Accepted Answer

Policy > Policy Elements > Conditions > Posture > Registry Condition. Posture conditions, such as checking for a specific registry key, are defined under Policy > Policy Elements > Conditions > Posture > Registry Condition. This allows you to create a condition that evaluates the presence of a registry key on the endpoint, which can then be used in posture policies.

Answer

Administration > System > Settings > Posture

Answer

Policy > Policy Elements > Conditions > Authorization > Compound Condition

Answer

Policy > Policy Elements > Results > Posture > Remediation Actions

Question 13

When configuring an 'Application Condition' to check for a specific version of an application, which operator is required to ensure the version is at least '10.5.0'?

Accepted Answer

Greater Than or Equal. The 'Greater Than or Equal' operator is the only one that evaluates a version comparison numerically, allowing the condition to match any version at or above 10.5.0 (e.g., 10.5.1, 10.6.0, 11.0.0). This is required when the goal is a minimum version threshold rather than an exact match.

Answer

Matches

Answer

Equals

Answer

Contains

Question 14

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

Accepted Answer

The device remains Non-Compliant. If an endpoint is determined to be Non-Compliant and no remediation action is configured, the device remains Non-Compliant. The posture policy will not automatically remediate or grant full access; the status persists until remediation is applied or the policy changes. Thus, option D is correct.

Answer

The agent automatically remediates the issue

Answer

The device is granted full access

Answer

The posture agent crashes

Question 15

You need to ensure that the AnyConnect posture agent is updated automatically. Where is this configured?

Accepted Answer

Client Provisioning Policy. The Client Provisioning Policy in Cisco ISE determines which software (such as the AnyConnect posture agent) is provisioned to endpoints and how it is updated. To ensure the AnyConnect posture agent is updated automatically, you configure the Client Provisioning Policy to point to the latest AnyConnect package and enable automatic upgrades. This policy controls the provisioning and update behavior.

Answer

Posture Policy > Settings

Answer

Posture Requirements

Answer

Remediation Actions