SISE Endpoint Compliance Practice Test 3 — 15 Questions

Question 1

Which of the following is required for AnyConnect to perform posture assessment on a Mac endpoint?

Accepted Answer

The 'AnyConnect Compliance Module' must be installed. The AnyConnect Compliance Module is required on a Mac endpoint to perform posture assessment. It provides the posture agents that check endpoint compliance with policies such as antivirus, firewall, and OS version.

Answer

The Mac must be domain joined

Answer

A separate 'Posture Proxy' must be configured

Answer

The user must have root access

Question 2

What is the purpose of the 'Posture Discovery' phase?

Accepted Answer

To identify if posture is required for the session. Posture Discovery is the phase where ISE determines whether posture assessment is required for the session at all. It evaluates the authorization policy and posture policy to decide if the endpoint should be posture-checked, and if so, which posture policy applies. It does not itself verify compliance or remediate — it only decides whether posture is in scope.

Answer

To verify the user credentials

Answer

To remediate non-compliant endpoints

Answer

To determine if the endpoint is compliant

Question 3

Which posture condition should be used to ensure a specific Windows patch (KB number) is installed?

Accepted Answer

Patch Condition. A Patch Condition in ISE posture is specifically designed to check for the presence of a particular Windows patch by its KB number (or a range of KBs). It queries the endpoint's update history and compares it against the configured KB values, returning compliant or non-compliant. This is the only condition type that directly targets patch-level granularity.

Answer

Registry Condition

Answer

Application Condition

Answer

File Condition

Question 4

What is the effect of setting a Posture Requirement to 'Optional'?

Accepted Answer

The user can choose to bypass the check without being blocked. Setting a posture requirement to 'Optional' means the check is still evaluated and reported, but the user is not blocked if it fails — they can choose to continue without remediation. This is used for monitoring or gradual rollout rather than enforcement.

Answer

The agent only checks when requested by the user

Answer

The agent will not perform the check at all

Answer

The device is automatically granted access

Question 5

If you want to use a script remediation, where do you define the script content?

Accepted Answer

Directly in the 'Script Remediation' action in ISE. In Cisco ISE, when configuring a posture policy with a script remediation action, the script content is defined directly within the 'Script Remediation' action itself. This allows the administrator to embed the script that will be executed on the endpoint to remediate the non-compliance.

Answer

In the Client Provisioning Resource file

Answer

In the Posture Policy XML

Answer

On the endpoint in the AnyConnect directory

Question 6

You need to allow users to remediate a non-compliant status manually. Which feature allows them to 'retry' the posture check after they have fixed the issue?

Accepted Answer

Re-scan button in the AnyConnect agent UI. The Re-scan button in the AnyConnect agent UI allows users to manually trigger a posture re-assessment after they have remediated the issue. This button is available in the AnyConnect posture module interface, enabling users to retry the posture check without waiting for a periodic scan or re-authenticating. It is the feature designed for manual remediation retry.

Answer

A remediation link that triggers a command

Answer

A periodic re-scan timer in the posture policy

Answer

Re-authentication via the 802.1X supplicant

Question 7

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

Accepted Answer

The FQDN of the Load Balancer VIP. The posture agent should point to the FQDN of the Load Balancer VIP to ensure it always reaches a PSN for assessment. In a high-availability environment, using a load balancer VIP provides a single, resilient endpoint that distributes requests across multiple PSNs. This avoids single points of failure and ensures that if one PSN goes down, the agent can still reach another PSN via the VIP.

Answer

The local gateway address

Answer

The IP address of the ISE Admin Node

Answer

A single static IP of the Primary PSN

Question 8

Which AnyConnect module is specifically required to perform posture assessment in ISE?

Accepted Answer

AnyConnect Compliance Module. The AnyConnect Compliance Module is the component that performs posture assessment on the endpoint. It collects information about the device's security state (e.g., antivirus, firewall, OS patches) and reports it to ISE for policy evaluation.

Answer

AnyConnect AMP Enabler

Answer

AnyConnect Web Security Module

Answer

AnyConnect VPN Module

Question 9

Which TWO of the following are valid components of an ISE Posture Policy?

Accepted Answer

Posture Requirement. In Cisco ISE, a Posture Policy is built from two core configurable components: Posture Requirements (option B), which define the conditions a client must satisfy (for example, an antivirus definition age or a specific registry/file check via the posture condition), and Remediation Actions (option D), which specify what ISE does when a requirement fails, such as showing a remediation message, linking to a download, or applying a restricted authorization result. These two elements are exactly what the posture policy editor lets you add per operating system and per posture condition, so B and D are the valid components. Option A (Identity Group) is a condition used in authorization or authentication policies, not a posture policy component. Option C (Authorization Policy Rule) is a separate policy set element that consumes posture status (e.g., Posture_Status = Compliant) but is not itself part of the posture policy. Option E (Certificate Profile) is used for certificate-based authentication and BYOD/trust operations, not for defining posture checks or remediation.

Answer

Identity Group

Answer

Authorization Policy Rule

Answer

Certificate Profile

Question 10

Which of the following is a posture requirement setting that defines how often the agent performs a re-scan?

Accepted Answer

Periodic Scanning Interval. The Periodic Scanning Interval is the specific posture requirement setting in Cisco ISE that controls how frequently the endpoint agent (e.g., Cisco AnyConnect ISE Posture module) performs a posture re-scan. It defines the time interval between automatic posture reassessments, ensuring that endpoints remain compliant with security policies throughout the session. This setting is configured within the posture policy under 'Periodic Reassessment' and directly answers the question of how often the agent re-scans.

Answer

Re-assessment Frequency

Answer

Scan Timeout

Answer

Policy Update Interval

Question 11

A posture condition is defined to check for a registry key, but it always returns 'Non-Compliant'. You suspect the 'Expected Value' is wrong. Where can you see what the agent actually found on the endpoint?

Accepted Answer

Operations > Reports > Endpoints > Posture Assessment. The Operations > Reports > Endpoints > Posture Assessment report provides detailed information about posture assessments, including the actual values found on the endpoint for each condition. This allows you to compare the expected value with what the agent reported, helping to diagnose why a condition is returning Non-Compliant.

Answer

Context Visibility > Endpoints

Answer

Client Provisioning > Resources

Answer

Policy > Posture > Conditions

Question 12

Which TWO of the following are prerequisites for the AnyConnect posture agent to function?

Accepted Answer

Connectivity to the ISE PSN. Option B is correct because the AnyConnect posture agent must reach an ISE Policy Services Node (PSN) to send posture assessment data and receive the posture decision (via the posture discovery and posture-report flow over HTTPS/port 8443), so connectivity to the ISE PSN is a prerequisite. Option D is correct because the posture agent is only supported on specific operating systems (for example, supported versions of Windows, macOS, and Linux) and will not function on an unsupported OS. Option A is not required because administrative rights on the server are not needed for the endpoint posture agent to operate. Option C is not required because the posture agent does not depend on a pre-installed VPN tunnel; posture can be evaluated before or independently of tunnel establishment. Option E is not required because the endpoint can use DHCP and does not need a static IP address for posture to work.

Answer

Administrative rights on the server

Answer

A pre-installed VPN tunnel

Answer

A static IP address on the endpoint

Question 13

Which TWO of the following steps are required to deploy the AnyConnect posture agent?

Accepted Answer

Create a Client Provisioning policy. Option C (Create a Client Provisioning policy) is correct because the Client Provisioning policy is what binds the posture requirements and the AnyConnect package to the matching conditions (OS, posture status, etc.) so that ISE can tell the endpoint which agent and profile to download. Option E (Create a Client Provisioning resource) is correct because the resource is the actual AnyConnect package/profile (or other agent) that ISE delivers to the endpoint; without a resource there is nothing for the policy to provision. Option A (Set the NAS IP address) is not required for posture agent deployment; the NAS IP is used in RADIUS/AAA device configuration and does not provision the agent. Option B (Enable RADIUS Accounting) is not required for deploying the posture agent; accounting is for session logging/accounting records, not for agent provisioning. Option D (Configure a TrustSec policy) is not required for posture agent deployment; TrustSec handles security group tagging/SGACL enforcement, which is separate from provisioning the AnyConnect posture module.

Answer

Set the NAS IP address

Answer

Enable RADIUS Accounting

Answer

Configure a TrustSec policy

Question 14

Which TWO of the following are true about Monitor Mode?

Accepted Answer

It logs posture results for analysis. Option B is correct because Monitor Mode in posture assessment (e.g., Cisco ISE or similar NAC solutions) records and logs the posture results of endpoints without enforcing any action, allowing administrators to analyze compliance data before enabling enforcement. Option E is correct because, in Monitor Mode, non-compliant endpoints are still granted network access since no enforcement policy is applied; the mode is purely observational. Option A is incorrect because Monitor Mode operates automatically once configured, requiring no per-session user intervention. Option C is incorrect because blocking traffic for non-compliant devices is characteristic of Enforcement Mode, not Monitor Mode. Option D is incorrect because automatically fixing compliance issues (remediation) is a separate function, often part of remediation or enforcement workflows, not Monitor Mode itself.

Answer

It requires user intervention

Answer

It blocks traffic for non-compliant devices

Answer

It automatically fixes compliance issues

Question 15

Which TWO of the following represent ways to verify the posture status of an endpoint?

Accepted Answer

View the status in the AnyConnect agent UI. Option B is correct because the Cisco AnyConnect (Secure Client) agent UI displays the endpoint's posture status directly, showing whether the system has passed or failed the posture policy checks performed by the agent in conjunction with ISE. Option E is correct because ISE's Posture Assessment Report provides a centralized view of posture results, including compliance details for each endpoint that has undergone posture evaluation. Option A is incorrect because DHCP server logs only record IP address lease assignments and contain no posture or compliance information. Option C is incorrect because switch port configuration defines Layer 2 settings such as VLANs, trunking, and port security, not endpoint posture state. Option D is incorrect because an AAA traffic dump captures RADIUS authentication and authorization exchanges but does not present a usable posture status verification view.

Answer

Check the DHCP server logs

Answer

Review the switch port configuration

Answer

Analyze the AAA traffic dump