SISE Endpoint Compliance — Timed 15 Questions

Question 1

A user is unable to pass posture assessment because the 'AnyConnect Compliance Module' is not detecting the antivirus software. Which log file on the endpoint should be reviewed to troubleshoot the compliance module's scanning logic?

15 minute time limit — choose an answer to begin.

Accepted Answer

AnyConnect Compliance Module log (ac_ise_posture.log). The AnyConnect Compliance Module log (ac_ise_posture.log) is the dedicated log file that records the compliance module's scanning activity, including which AV products it detects, which registry keys or WMI queries it inspects, and why a particular check passed or failed. When the module fails to detect installed antivirus software, this log shows the exact detection method attempted and the result, making it the correct troubleshooting source.

Answer

NAC Agent Log (nac_agent.log)

Answer

Windows Event Viewer - Application Log

Answer

ISE Posture Log (ise_posture.log)

Question 2

When configuring an AnyConnect Posture Policy, which option allows the administrator to force the agent to perform a scan regardless of the current posture status?

Accepted Answer

Agent Enforcement set to 'Mandatory'. The 'Mandatory' setting in the Posture Requirement forces the agent to report status and remediate if necessary, whereas 'Optional' allows the user to skip.

Answer

Posture Type set to 'Continuos'

Answer

Policy Status set to 'Production'

Question 3

Which of the following is a valid remediation action type in Cisco ISE?

Accepted Answer

File Remediation. File Remediation is one of the remediation action types ISE supports, alongside Antivirus Remediation, Windows Update Remediation, and Link Remediation. It allows the posture policy to push a file (such as an updated AV definition or a required patch installer) to the non-compliant endpoint via the AnyConnect/WebAgent posture module.

Answer

Process Kill Remediation

Answer

Network Remediation

Answer

User Prompt Remediation

Question 4

Which component is responsible for triggering the posture assessment process when a user connects to the network?

Accepted Answer

Posture Policy. The posture policy in Cisco ISE defines the conditions and requirements that an endpoint must meet (e.g., antivirus running, patches installed) and is what triggers the posture assessment workflow. When a session matches a posture policy, ISE instructs the NAD to redirect the endpoint to the posture agent or web portal, initiating the assessment. Without a posture policy, no assessment is triggered even if the client has the posture module installed.

Answer

Network Access Device (NAD)

Answer

AnyConnect Compliance Module

Answer

RADIUS Server

Question 5

Which menu path allows you to view the posture compliance status of all endpoints?

Accepted Answer

Context Visibility > Endpoints. In Cisco ISE, the posture compliance status of all endpoints is available through two distinct menu paths: Context Visibility > Endpoints and Operations > Reports > Endpoints and Users > Posture Assessment. Context Visibility > Endpoints provides a real-time, filterable dashboard showing each endpoint's posture status (Compliant, Non-Compliant, Unknown, etc.) along with other attributes. The Operations report path offers a more report-centric view, allowing you to generate and export detailed posture assessment reports. Both are valid ways to view posture compliance across all endpoints, making options A and B correct.

Answer

Administration > Identity Management

Answer

Policy > Posture > Reports

Question 6

A user is compliant, but ISE still classifies the device as 'Unknown'. What is the most likely cause?

Accepted Answer

The posture agent failed to connect to the PSN. If a user is compliant but ISE still shows the device as 'Unknown', the most likely cause is that the posture agent failed to connect to the PSN, so ISE never received the posture assessment and cannot update the endpoint's identity/classification. Without that communication, ISE retains the default 'Unknown' classification even though the endpoint itself reports compliance locally.

Answer

The Client Provisioning policy is misconfigured

Answer

The remediation action is disabled

Answer

The authorization rule is incorrect

Question 7

When using AnyConnect as the posture agent, how can you prevent users from disabling the posture service?

Accepted Answer

By disabling the 'Allow Stop' option in the AnyConnect profile. The 'Allow Stop' option in the AnyConnect profile controls whether users can stop the posture service from the AnyConnect UI. Disabling this option (D) prevents users from manually terminating the posture agent, ensuring continuous compliance enforcement. This is the direct, profile-level control for this requirement.

Answer

By configuring a 'Mandatory' posture requirement

Answer

By setting the 'Posture Type' to 'System'

Answer

By enabling 'Auto-Restart' in the ISE global settings

Question 8

During a troubleshooting session, you notice that the AnyConnect agent is not receiving the posture policy. Which log file on the ISE Policy Service Node (PSN) should you examine?

Accepted Answer

ise-psc.log. The ise-psc.log on the Policy Service Node records Policy Service Node (PSN) activity, including posture policy delivery and AnyConnect posture agent interactions. When the agent is not receiving the posture policy, this log captures the policy evaluation and communication between ISE and the endpoint agent, making it the correct file to examine.

Answer

prrt-server.log

Answer

guest.log

Answer

admin.log

Question 9

Which THREE of the following are valid types of Posture Conditions?

Accepted Answer

Service Condition. Service Condition (A) is correct because posture policies in Network Access Control (NAC) solutions such as Cisco ISE commonly evaluate whether specific services (e.g., antivirus or firewall services) are running on the endpoint. File Condition (B) is correct because posture checks can verify the existence, version, or hash of a required file (e.g., an updated antivirus signature file) on the endpoint. Registry Condition (E) is correct because posture assessment can inspect Windows registry keys and values to confirm required security settings or software configurations. User Identity Condition (C) is not a posture condition type; user identity is handled through authentication and authorization policies, not endpoint posture evaluation. Port Condition (D) is not a posture condition type; port-based checks relate to network access control at the switch or firewall level rather than endpoint posture assessment.

Answer

User Identity Condition

Answer

Port Condition

Question 10

Which THREE of the following are valid remediation actions?

Accepted Answer

Service Remediation. Service Remediation (A) is valid because remediation can target Windows services, e.g., stopping/starting or reconfiguring a service via sc.exe or Set-Service to close a vulnerable or misconfigured service. Registry Remediation (B) is valid because registry keys and values (e.g., under HKLM\Software or HKLM\System) can be modified or deleted via reg.exe or PowerShell to remove insecure settings or persistence. File Remediation (E) is valid because files can be quarantined, deleted, or replaced (e.g., via Remove-Item or antivirus quarantine) to eliminate malicious or vulnerable content. VLAN Remediation (C) is not a standard remediation category, since VLANs are network segmentation constructs rather than directly remediated objects. ACL Remediation (D) is likewise not a recognized remediation type in this context; ACLs are access-control configurations, not a distinct remediation action category.

Answer

VLAN Remediation

Answer

ACL Remediation

Question 11

Which THREE of the following items are configured in an AnyConnect Posture Requirement?

Accepted Answer

Condition. In an AnyConnect Posture Requirement, the Condition (A) defines the actual endpoint check that must be evaluated, such as a registry key, file, process, or application state, so it is a core configured element. The Operating System (B) is also configured because posture requirements are scoped to specific OS types (for example Windows, macOS, or Linux), allowing different checks per platform. The Remediation Action (E) is configured to specify what happens when the condition fails, such as displaying a message, requiring a file, or linking to a remediation server. Device ID (C) is not a posture requirement item; it is an endpoint attribute used elsewhere for identification or profiling. Authorization Rule (D) is not part of the posture requirement itself; it is an ASA/ISE policy construct that references posture results to grant or deny access.

Answer

Device ID

Answer

Authorization Rule

Question 12

Which THREE of the following are valid operators for a Registry Condition?

Accepted Answer

Equals. In a Registry Condition, the valid comparison operators are Equals, Starts With, and Contains, which are used to match registry key or value data against a specified string. Option B (Equals) is correct because it performs an exact match on the registry value or key name. Option C (Starts With) is correct because it matches registry entries whose value begins with the specified string, useful for prefix-based filtering. Option D (Contains) is correct because it matches registry entries that include the specified substring anywhere in the value. Options A (Includes All) and E (Exists Only) are not valid Registry Condition operators; 'Includes All' is not a recognized operator, and existence checks are handled by the condition type itself rather than an 'Exists Only' operator.

Answer

Includes All

Answer

Exists Only

Question 13

An administrator is troubleshooting a posture failure where the AnyConnect agent is installed but ISE reports the endpoint as 'Unknown'. Which configuration setting in the Posture Policy is most likely misconfigured?

Accepted Answer

The Posture Policy is not associated with the correct Authorization Profile used in the Authorization Policy.. When AnyConnect is installed but ISE reports the endpoint as 'Unknown', the most common cause is that the Posture Policy is not associated with the correct Authorization Profile used in the Authorization Policy (D). The Authorization Profile must reference the posture policy so ISE knows which posture checks to run and can transition the endpoint from Unknown to Compliant/Non-Compliant.

Answer

The Compliance Module is not installed on the ISE server.

Answer

The Remediation Action is disabled.

Answer

The Posture Agent configuration is missing the server discovery URL.

Answer

The ISE server certificate is not trusted by the client.

Question 14

You are configuring a 'Registry' check as part of a posture requirement. The goal is to ensure a specific registry key exists to prove a corporate application is configured correctly. What is the correct way to specify the path if the key is located in HKEY_LOCAL_MACHINE?

Accepted Answer

Use 'HKLM' as the root of the path.. When configuring a Registry posture check in ISE, the root of the path must be specified as 'HKLM' (or HKCU, HKCR, etc.), not the full 'HKEY_LOCAL_MACHINE' string. ISE expects the abbreviated root followed by the subkey path, so 'HKLM' is the correct root token.

Answer

Use 'ROOT:HKLM'.

Answer

The path must be relative to the user profile, so HKLM is invalid.

Answer

Use a backslash prefix like '\HKLM'.

Answer

Use the full string 'HKEY_LOCAL_MACHINE' at the start of the path.

Question 15

Which TWO of the following are valid remediation actions available in Cisco ISE for posture compliance?

Accepted Answer

Link Remediation. Link Remediation (B) is a valid ISE posture remediation action that redirects a non-compliant endpoint to a remediation web portal where the user can download and install the required software, so it directly addresses posture compliance. File Remediation (E) is also valid: ISE can push a specific file (for example, an installer or script) to the endpoint to bring it into compliance, making it a supported posture remediation type. MAC Authentication Bypass (A) is an authentication method for devices that cannot run 802.1X supplicants, not a posture remediation action. VLAN Change (C) is an authorization result used to restrict network access, not a remediation mechanism within posture policy. Downloadable ACL (D) is an authorization component that enforces traffic filtering on the switch, not a posture remediation action.

Answer

MAC Authentication Bypass

Answer

VLAN Change

Answer

Downloadable ACL