SISE Endpoint Compliance — Timed 25 Questions

Question 1

A user is unable to pass posture assessment because the 'AnyConnect Compliance Module' is not detecting the antivirus software. Which log file on the endpoint should be reviewed to troubleshoot the compliance module's scanning logic?

25 minute time limit — choose an answer to begin.

Accepted Answer

AnyConnect Compliance Module log (ac_ise_posture.log). The AnyConnect Compliance Module log (ac_ise_posture.log) is the dedicated log file that records the compliance module's scanning activity, including which AV products it detects, which registry keys or WMI queries it inspects, and why a particular check passed or failed. When the module fails to detect installed antivirus software, this log shows the exact detection method attempted and the result, making it the correct troubleshooting source.

Answer

NAC Agent Log (nac_agent.log)

Answer

Windows Event Viewer - Application Log

Answer

ISE Posture Log (ise_posture.log)

Question 2

When configuring an AnyConnect Posture Policy, which option allows the administrator to force the agent to perform a scan regardless of the current posture status?

Accepted Answer

Agent Enforcement set to 'Mandatory'. The 'Mandatory' setting in the Posture Requirement forces the agent to report status and remediate if necessary, whereas 'Optional' allows the user to skip.

Answer

Posture Type set to 'Continuos'

Answer

Policy Status set to 'Production'

Question 3

Which of the following is a valid remediation action type in Cisco ISE?

Accepted Answer

File Remediation. File Remediation is one of the remediation action types ISE supports, alongside Antivirus Remediation, Windows Update Remediation, and Link Remediation. It allows the posture policy to push a file (such as an updated AV definition or a required patch installer) to the non-compliant endpoint via the AnyConnect/WebAgent posture module.

Answer

Process Kill Remediation

Answer

Network Remediation

Answer

User Prompt Remediation

Question 4

Which component is responsible for triggering the posture assessment process when a user connects to the network?

Accepted Answer

Posture Policy. The posture policy in Cisco ISE defines the conditions and requirements that an endpoint must meet (e.g., antivirus running, patches installed) and is what triggers the posture assessment workflow. When a session matches a posture policy, ISE instructs the NAD to redirect the endpoint to the posture agent or web portal, initiating the assessment. Without a posture policy, no assessment is triggered even if the client has the posture module installed.

Answer

Network Access Device (NAD)

Answer

AnyConnect Compliance Module

Answer

RADIUS Server

Question 5

Which menu path allows you to view the posture compliance status of all endpoints?

Accepted Answer

Context Visibility > Endpoints. In Cisco ISE, the posture compliance status of all endpoints is available through two distinct menu paths: Context Visibility > Endpoints and Operations > Reports > Endpoints and Users > Posture Assessment. Context Visibility > Endpoints provides a real-time, filterable dashboard showing each endpoint's posture status (Compliant, Non-Compliant, Unknown, etc.) along with other attributes. The Operations report path offers a more report-centric view, allowing you to generate and export detailed posture assessment reports. Both are valid ways to view posture compliance across all endpoints, making options A and B correct.

Answer

Administration > Identity Management

Answer

Policy > Posture > Reports

Question 6

A user is compliant, but ISE still classifies the device as 'Unknown'. What is the most likely cause?

Accepted Answer

The posture agent failed to connect to the PSN. If a user is compliant but ISE still shows the device as 'Unknown', the most likely cause is that the posture agent failed to connect to the PSN, so ISE never received the posture assessment and cannot update the endpoint's identity/classification. Without that communication, ISE retains the default 'Unknown' classification even though the endpoint itself reports compliance locally.

Answer

The Client Provisioning policy is misconfigured

Answer

The remediation action is disabled

Answer

The authorization rule is incorrect

Question 7

When using AnyConnect as the posture agent, how can you prevent users from disabling the posture service?

Accepted Answer

By disabling the 'Allow Stop' option in the AnyConnect profile. The 'Allow Stop' option in the AnyConnect profile controls whether users can stop the posture service from the AnyConnect UI. Disabling this option (D) prevents users from manually terminating the posture agent, ensuring continuous compliance enforcement. This is the direct, profile-level control for this requirement.

Answer

By configuring a 'Mandatory' posture requirement

Answer

By setting the 'Posture Type' to 'System'

Answer

By enabling 'Auto-Restart' in the ISE global settings

Question 8

During a troubleshooting session, you notice that the AnyConnect agent is not receiving the posture policy. Which log file on the ISE Policy Service Node (PSN) should you examine?

Accepted Answer

ise-psc.log. The ise-psc.log on the Policy Service Node records Policy Service Node (PSN) activity, including posture policy delivery and AnyConnect posture agent interactions. When the agent is not receiving the posture policy, this log captures the policy evaluation and communication between ISE and the endpoint agent, making it the correct file to examine.

Answer

prrt-server.log

Answer

guest.log

Answer

admin.log

Question 9

Which THREE of the following are valid types of Posture Conditions?

Accepted Answer

Service Condition. Service Condition (A) is correct because posture policies in Network Access Control (NAC) solutions such as Cisco ISE commonly evaluate whether specific services (e.g., antivirus or firewall services) are running on the endpoint. File Condition (B) is correct because posture checks can verify the existence, version, or hash of a required file (e.g., an updated antivirus signature file) on the endpoint. Registry Condition (E) is correct because posture assessment can inspect Windows registry keys and values to confirm required security settings or software configurations. User Identity Condition (C) is not a posture condition type; user identity is handled through authentication and authorization policies, not endpoint posture evaluation. Port Condition (D) is not a posture condition type; port-based checks relate to network access control at the switch or firewall level rather than endpoint posture assessment.

Answer

User Identity Condition

Answer

Port Condition

Question 10

Which THREE of the following are valid remediation actions?

Accepted Answer

Service Remediation. Service Remediation (A) is valid because remediation can target Windows services, e.g., stopping/starting or reconfiguring a service via sc.exe or Set-Service to close a vulnerable or misconfigured service. Registry Remediation (B) is valid because registry keys and values (e.g., under HKLM\Software or HKLM\System) can be modified or deleted via reg.exe or PowerShell to remove insecure settings or persistence. File Remediation (E) is valid because files can be quarantined, deleted, or replaced (e.g., via Remove-Item or antivirus quarantine) to eliminate malicious or vulnerable content. VLAN Remediation (C) is not a standard remediation category, since VLANs are network segmentation constructs rather than directly remediated objects. ACL Remediation (D) is likewise not a recognized remediation type in this context; ACLs are access-control configurations, not a distinct remediation action category.

Answer

VLAN Remediation

Answer

ACL Remediation

Question 11

Which THREE of the following items are configured in an AnyConnect Posture Requirement?

Accepted Answer

Condition. In an AnyConnect Posture Requirement, the Condition (A) defines the actual endpoint check that must be evaluated, such as a registry key, file, process, or application state, so it is a core configured element. The Operating System (B) is also configured because posture requirements are scoped to specific OS types (for example Windows, macOS, or Linux), allowing different checks per platform. The Remediation Action (E) is configured to specify what happens when the condition fails, such as displaying a message, requiring a file, or linking to a remediation server. Device ID (C) is not a posture requirement item; it is an endpoint attribute used elsewhere for identification or profiling. Authorization Rule (D) is not part of the posture requirement itself; it is an ASA/ISE policy construct that references posture results to grant or deny access.

Answer

Device ID

Answer

Authorization Rule

Question 12

Which THREE of the following are valid operators for a Registry Condition?

Accepted Answer

Equals. In a Registry Condition, the valid comparison operators are Equals, Starts With, and Contains, which are used to match registry key or value data against a specified string. Option B (Equals) is correct because it performs an exact match on the registry value or key name. Option C (Starts With) is correct because it matches registry entries whose value begins with the specified string, useful for prefix-based filtering. Option D (Contains) is correct because it matches registry entries that include the specified substring anywhere in the value. Options A (Includes All) and E (Exists Only) are not valid Registry Condition operators; 'Includes All' is not a recognized operator, and existence checks are handled by the condition type itself rather than an 'Exists Only' operator.

Answer

Includes All

Answer

Exists Only

Question 13

An administrator is troubleshooting a posture failure where the AnyConnect agent is installed but ISE reports the endpoint as 'Unknown'. Which configuration setting in the Posture Policy is most likely misconfigured?

Accepted Answer

The Posture Policy is not associated with the correct Authorization Profile used in the Authorization Policy.. When AnyConnect is installed but ISE reports the endpoint as 'Unknown', the most common cause is that the Posture Policy is not associated with the correct Authorization Profile used in the Authorization Policy (D). The Authorization Profile must reference the posture policy so ISE knows which posture checks to run and can transition the endpoint from Unknown to Compliant/Non-Compliant.

Answer

The Compliance Module is not installed on the ISE server.

Answer

The Remediation Action is disabled.

Answer

The Posture Agent configuration is missing the server discovery URL.

Answer

The ISE server certificate is not trusted by the client.

Question 14

You are configuring a 'Registry' check as part of a posture requirement. The goal is to ensure a specific registry key exists to prove a corporate application is configured correctly. What is the correct way to specify the path if the key is located in HKEY_LOCAL_MACHINE?

Accepted Answer

Use 'HKLM' as the root of the path.. When configuring a Registry posture check in ISE, the root of the path must be specified as 'HKLM' (or HKCU, HKCR, etc.), not the full 'HKEY_LOCAL_MACHINE' string. ISE expects the abbreviated root followed by the subkey path, so 'HKLM' is the correct root token.

Answer

Use 'ROOT:HKLM'.

Answer

The path must be relative to the user profile, so HKLM is invalid.

Answer

Use a backslash prefix like '\HKLM'.

Answer

Use the full string 'HKEY_LOCAL_MACHINE' at the start of the path.

Question 15

Which TWO of the following are valid remediation actions available in Cisco ISE for posture compliance?

Accepted Answer

Link Remediation. Link Remediation (B) is a valid ISE posture remediation action that redirects a non-compliant endpoint to a remediation web portal where the user can download and install the required software, so it directly addresses posture compliance. File Remediation (E) is also valid: ISE can push a specific file (for example, an installer or script) to the endpoint to bring it into compliance, making it a supported posture remediation type. MAC Authentication Bypass (A) is an authentication method for devices that cannot run 802.1X supplicants, not a posture remediation action. VLAN Change (C) is an authorization result used to restrict network access, not a remediation mechanism within posture policy. Downloadable ACL (D) is an authorization component that enforces traffic filtering on the switch, not a posture remediation action.

Answer

MAC Authentication Bypass

Answer

VLAN Change

Answer

Downloadable ACL

Question 16

Which THREE conditions are required for successful AnyConnect posture assessment in a wired network environment?

Accepted Answer

The endpoint must have the AnyConnect agent installed.. Option B is correct because successful posture assessment requires the AnyConnect agent (with the ISE Posture module) to be installed on the endpoint, since it is the agent that performs the posture checks and communicates with ISE. Option C is correct because the Client Provisioning service on the ISE PSN is responsible for delivering the posture policy, agent provisioning, and compliance modules to the endpoint during the posture flow. Option D is correct because an Authorization Profile configured for posture redirection (using a redirect ACL and URL) is needed to steer the endpoint into the posture process before full network access is granted. Option A is incorrect because WebAuth is a web authentication method for guest or BYOD flows, not a requirement for posture assessment in a wired environment. Option E is incorrect because Active Directory domain membership is not required for posture assessment; posture can be evaluated for non-domain endpoints as well.

Answer

The switch must be configured for WebAuth.

Answer

The endpoint must be joined to an Active Directory domain.

Question 17

An administrator has configured a posture policy that requires Windows endpoints to have the latest Windows Defender definitions. A user reports that after connecting, the AnyConnect posture agent shows a non-compliant status, but the user is not automatically redirected to a remediation portal. The administrator confirms that the posture policy is correctly assigned and the agent is installed. What is the most likely reason the user is not being redirected?

Accepted Answer

The posture policy is set to 'Audit' mode instead of 'Enforce' mode.. The posture policy's enforcement mode determines whether ISE redirects non-compliant endpoints to a remediation portal. In Audit mode, ISE only monitors and logs compliance without enforcing. The user sees the non-compliant status but is not redirected. Changing the mode to Enforce activates the configured remediation actions, including redirection.

Answer

The Windows Defender definitions are not included in the posture condition.

Answer

The remediation action is not configured to 'Auto Remediate'.

Answer

The AnyConnect posture agent is not configured to allow redirection.

Question 18

A network administrator is deploying posture assessment for a group of corporate-owned macOS endpoints. The administrator wants to ensure that the endpoints are checked for specific security requirements before being granted full network access. The administrator has already installed the AnyConnect posture agent and configured the necessary conditions. Which two additional components are required to complete the posture configuration? (Choose two.)

Accepted Answer

Posture policy. To enable posture assessment, ISE requires a posture policy that defines the checks and a client provisioning policy that specifies which posture agent to provision. The posture policy evaluates conditions and determines compliance, while the client provisioning policy ensures the agent is installed and configured correctly. Other policies like authorization and profiling are important for overall network access control but are not part of the core posture configuration.

Answer

Remediation policy

Answer

Profiling policy

Answer

Authorization policy

Question 19

A security engineer is configuring posture remediation for Windows endpoints. When an endpoint fails a posture check for missing antivirus definitions, the engineer wants to automatically trigger a definition update without user interaction. The engineer configures a remediation action of type 'Windows Server Update Services (WSUS)' and associates it with the posture policy. However, after testing, the remediation does not start. What is the most likely reason?

Accepted Answer

The WSUS remediation action requires that the endpoint be a member of an Active Directory domain and have the WSUS client configured to use the specified WSUS server.. The WSUS remediation action requires the endpoint to be domain-joined and configured to use the specified WSUS server. Without this, the Windows Update Agent cannot locate the WSUS server, and remediation fails. The other options are either incorrect platform assumptions or would result in different symptoms, such as no posture assessment at all.

Answer

The remediation action is not supported on Windows endpoints; it is only available for macOS and Linux.

Answer

The posture policy is set to 'Audit' mode, which prevents remediation actions from executing.

Answer

The remediation action requires the AnyConnect posture module to be installed and running, but it is not.

Question 20

An administrator is troubleshooting a posture issue where a Windows endpoint is marked as Non-Compliant for a check that verifies the presence of a specific service. The AnyConnect Posture module is installed and running. The administrator runs the AnyConnect Diagnostics and Reporting Tool (DART) and sees that the service check returned a value of 'Not Found', but the service is actually running on the endpoint. What is the most likely cause of this discrepancy?

Accepted Answer

The service name in the posture condition is case-sensitive and does not match the actual service name.. Posture conditions that check for Windows services compare the specified service name against the actual service name. If the condition uses a service name with different casing than the actual service, and the comparison is case-sensitive, the check will fail even though the service is running. Ensuring the service name matches exactly, including case, resolves the issue.

Answer

The service is set to start manually and is not currently running, so the posture check correctly reports it as not found.

Answer

The AnyConnect Posture module does not have sufficient permissions to query the service status.

Answer

The posture condition is configured to check for a process instead of a service, causing a mismatch.