CCNA Endpoint Compliance Questions

MCQmedium

You need to allow users to remediate a non-compliant status manually. Which feature allows them to 'retry' the posture check after they have fixed the issue?

A.A remediation link that triggers a command

B.Re-scan button in the AnyConnect agent UI

C.A periodic re-scan timer in the posture policy

D.Re-authentication via the 802.1X supplicant

AnswerB

This is the native feature for manual triggering of a re-scan.

Why this answer

The AnyConnect agent provides a 'Retry' or 'Re-scan' button in the UI once a non-compliant state is detected.

Practice this question →

MCQmedium

You need to ensure that the AnyConnect posture agent is updated automatically. Where is this configured?

A.Posture Policy > Settings

B.Posture Requirements

C.Remediation Actions

D.Client Provisioning Policy

AnswerD

This policy determines which agent version is pushed to endpoints.

Why this answer

The 'Agent Lifecycle' or 'Client Provisioning' settings allow you to define versioning and update requirements.

Practice this question →

MCQeasy

What is the effect of setting a Posture Requirement to 'Optional'?

A.The agent only checks when requested by the user

B.The agent will not perform the check at all

C.The user can choose to bypass the check without being blocked

D.The device is automatically granted access

AnswerC

Optional means compliance is not enforced for access control.

Why this answer

Optional means the agent will perform the check, but if the endpoint is non-compliant, the access is not restricted based on that specific requirement.

Practice this question →

MCQmedium

When using AnyConnect as the posture agent, how can you prevent users from disabling the posture service?

A.By configuring a 'Mandatory' posture requirement

B.By setting the 'Posture Type' to 'System'

C.By enabling 'Auto-Restart' in the ISE global settings

D.By disabling the 'Allow Stop' option in the AnyConnect profile

AnswerD

This prevents users from manually stopping the AnyConnect service.

Why this answer

The AnyConnect profile (xml) can be configured to hide the UI or prevent the service from being stopped by non-admin users.

Practice this question →

Multi-Selecthard

Which TWO of the following represent ways to verify the posture status of an endpoint?

Select 2 answers

A.Check the DHCP server logs

B.View the status in the AnyConnect agent UI

C.Review the switch port configuration

D.Analyze the AAA traffic dump

E.Check the Posture Assessment Report on ISE

AnswersB, E

The user can see the status locally.

Why this answer

You can check the ISE reports or the endpoint's AnyConnect UI.

Practice this question →

MCQmedium

Which posture condition should be used to ensure a specific Windows patch (KB number) is installed?

A.Registry Condition

B.Application Condition

C.File Condition

D.Patch Condition

AnswerD

This is the dedicated condition type for checking Windows KB updates.

Why this answer

A 'Patch Condition' is used specifically to verify the presence of Windows updates/patches.

Practice this question →

MCQmedium

You are configuring a Posture policy in Cisco ISE and need to ensure that endpoints running an outdated version of Windows are directed to a specific remediation portal. Which component must you configure to define the conditions that trigger this remediation?

A.Posture Requirements

B.Client Provisioning Policies

C.Remediation Actions

D.Posture Policies

AnswerA

Posture requirements define the conditions that must be checked, such as OS version, and link to the specific remediation action if the condition fails.

Why this answer

Posture requirements are the components that define the specific checks (e.g., OS version, registry keys) that must be met to reach a compliant state; if not met, the remediation action is triggered.

Practice this question →

MCQeasy

Which menu path allows you to view the posture compliance status of all endpoints?

A.Context Visibility > Endpoints

B.Operations > Reports > Endpoints and Users > Posture Assessment

C.Administration > Identity Management

D.Policy > Posture > Reports

AnswerA, B

(Self-correction: Both are valid, but the question asks for the path to the report specifically).

Why this answer

Operations > Reports > Endpoints and Users > Posture Assessment is the standard path to view posture-specific reports.

Practice this question →

MCQeasy

When deploying the AnyConnect Posture agent, which specific file must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment?

A.AnyConnect Diagnostic and Reporting Tool

B.AnyConnect ISE Posture Agent profile

C.AnyConnect Compliance Module

D.AnyConnect VPN package

AnswerC

The Compliance Module is mandatory for the posture agent to perform granular checks on the endpoint.

Why this answer

To enable posture assessment, you must upload the AnyConnect Compliance Module, which contains the logic for checking OS and application compliance.

Practice this question →

MCQhard

A user is complaining that they are stuck in a posture remediation loop despite having the latest antivirus software installed. You verify that the AV check is correctly configured. What is the most likely cause for this behavior?

A.The ISE server is in maintenance mode.

B.The AnyConnect Compliance Module is outdated on the endpoint.

C.The Posture Policy is disabled.

D.The Authorization policy uses the wrong group.

E.The Remediation action requires a reboot that hasn't occurred.

AnswerB

If the compliance module is outdated, it may not recognize the latest versions of antivirus software installed on the system.

Why this answer

If the AV software is installed but the posture agent does not recognize it, the version or the specific product identifier in the requirement might be slightly off, or the agent is not receiving the latest compliance library updates.

Practice this question →

MCQeasy

What is the purpose of the 'Posture Discovery' phase?

A.To verify the user credentials

B.To remediate non-compliant endpoints

C.To identify if posture is required for the session

D.To determine if the endpoint is compliant

AnswerC

Discovery determines the policy applicability.

Why this answer

Discovery is the initial communication where the agent identifies the ISE PSN and checks if a posture policy exists.

Practice this question →

Multi-Selectmedium

Which THREE of the following are valid types of Posture Conditions?

Select 3 answers

A.Service Condition

B.File Condition

C.User Identity Condition

D.Port Condition

E.Registry Condition

AnswersA, B, E

Checks for service running status.

Why this answer

ISE supports multiple condition types including File, Registry, and Service checks.

Practice this question →

MCQmedium

Which protocol is used by the AnyConnect agent to communicate posture information to the ISE Policy Service Node (PSN)?

A.RADIUS

B.HTTP/HTTPS (TCP 8905)

C.DNS

D.SNMP

AnswerB

The Cisco ISE posture agent communicates with the PSN over TCP port 8905.

Why this answer

ISE posture agents use HTTPS (TCP 8905) for communication with the PSN.

Practice this question →

MCQeasy

Which of the following is a posture requirement setting that defines how often the agent performs a re-scan?

A.Periodic Scanning Interval

B.Re-assessment Frequency

C.Scan Timeout

D.Policy Update Interval

AnswerA

This setting defines the frequency of posture re-assessment.

Why this answer

The 'Periodic Scanning' setting in the posture policy defines the interval for re-scanning.

Practice this question →

MCQmedium

You are creating a File Requirement for posture assessment. What is the required behavior if you want to confirm that a specific file exists on the client machine?

A.Set the Check type to 'Exists' and provide the full file path.

B.Set the Check type to 'Status' and provide the service name.

C.Set the Check type to 'Registry' and provide the key path.

D.Set the Check type to 'Version' and provide the file size.

E.Set the Check type to 'Content' and provide the file hash.

AnswerA

The 'Exists' check is the standard method for verifying file presence as a compliance condition.

Why this answer

In a File Requirement, setting the condition to 'Exists' allows the agent to verify the presence of a specific file path on the local drive.

Practice this question →

MCQhard

When configuring an 'Application Condition' to check for a specific version of an application, which operator is required to ensure the version is at least '10.5.0'?

A.Matches

B.Greater Than or Equal

C.Equals

D.Contains

AnswerB

This ensures the version is 10.5.0 or higher.

Why this answer

The 'Greater Than or Equal' operator is necessary to ensure the version meets or exceeds the security requirement.

Practice this question →

Multi-Selectmedium

Which TWO of the following are prerequisites for the AnyConnect posture agent to function?

Select 2 answers

A.Administrative rights on the server

B.Connectivity to the ISE PSN

C.A pre-installed VPN tunnel

D.A supported operating system

E.A static IP address on the endpoint

AnswersB, D

Agent must talk to PSN.

Why this answer

The agent needs to reach the PSN and be supported by the endpoint OS.

Practice this question →

MCQhard

You are configuring a 'Registry' check as part of a posture requirement. The goal is to ensure a specific registry key exists to prove a corporate application is configured correctly. What is the correct way to specify the path if the key is located in HKEY_LOCAL_MACHINE?

A.Use 'ROOT:HKLM'.

B.The path must be relative to the user profile, so HKLM is invalid.

C.Use 'HKLM' as the root of the path.

D.Use a backslash prefix like '\\HKLM'.

E.Use the full string 'HKEY_LOCAL_MACHINE' at the start of the path.

AnswerC

ISE requires the standard registry root abbreviations, with HKLM being the correct prefix for HKEY_LOCAL_MACHINE.

Why this answer

In Cisco ISE posture requirement configurations, you must use the 'HKLM' abbreviation for the HKEY_LOCAL_MACHINE root key when defining the path.

Practice this question →

MCQhard

An administrator is troubleshooting a posture failure where the AnyConnect agent is installed but ISE reports the endpoint as 'Unknown'. Which configuration setting in the Posture Policy is most likely misconfigured?

A.The Compliance Module is not installed on the ISE server.

B.The Remediation Action is disabled.

C.The Posture Agent configuration is missing the server discovery URL.

D.The Posture Policy is not associated with the correct Authorization Profile used in the Authorization Policy.

E.The ISE server certificate is not trusted by the client.

AnswerD

If the Authorization Profile does not trigger the posture flow, the agent remains in an unknown state because the ISE server does not send the posture discovery request.

Why this answer

If the agent is installed but shows 'Unknown', it usually indicates the agent is not successfully checking in or the Posture Policy is not correctly mapped to the authorization profile currently applied to the session.

Practice this question →

Multi-Selecteasy

Which TWO of the following are true about Monitor Mode?

Select 2 answers

A.It requires user intervention

B.It logs posture results for analysis

C.It blocks traffic for non-compliant devices

D.It automatically fixes compliance issues

E.It allows network access for non-compliant endpoints

AnswersB, E

Visibility is the goal of monitor mode.

Why this answer

Monitor mode allows visibility without blocking access.

Practice this question →

MCQhard

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

A.The FQDN of the Load Balancer VIP

B.The local gateway address

C.The IP address of the ISE Admin Node

D.A single static IP of the Primary PSN

AnswerA

A VIP ensures the agent can connect to any available PSN.

Why this answer

The AnyConnect profile should contain a list of PSNs or a load-balanced VIP to ensure redundancy.

Practice this question →

MCQeasy

What is the primary function of the 'Monitor Mode' in Cisco ISE Posture policies?

A.To gather compliance data without restricting network access

B.To automatically remediate endpoints

C.To bypass the posture check entirely

D.To block all traffic until the agent is installed

AnswerA

Monitor Mode is explicitly for visibility without enforcement.

Why this answer

Monitor Mode allows administrators to log posture results without denying access, facilitating testing before enforcement.

Practice this question →

MCQeasy

Where do you upload the AnyConnect posture agent packages to make them available for Client Provisioning?

A.Operations > Troubleshoot > Client Provisioning

B.Policy > Policy Elements > Results > Client Provisioning > Resources

C.Policy > Posture > Policy

D.Administration > System > Settings > Posture

AnswerB

This is the designated location for uploading agent binaries.

Why this answer

Client Provisioning resources are managed under Policy > Policy Elements > Results > Client Provisioning > Resources.

Practice this question →

Multi-Selectmedium

Which THREE of the following are valid operators for a Registry Condition?

Select 3 answers

A.Includes All

B.Equals

C.Starts With

D.Contains

E.Exists Only

AnswersB, C, D

Valid operator.

Why this answer

Standard operators include Equals, Contains, and Starts With.

Practice this question →

MCQmedium

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

A.Post-Posture Authorization Rule

B.Client Provisioning Policy

C.File Remediation Action

D.Posture Requirement

AnswerC

File Remediation is specifically designed to provide a download link or location for remediation software.

Why this answer

A File Remediation action allows you to specify a URL or a path to a file that the client can download to remediate compliance.

Practice this question →

Multi-Selecthard

Which THREE of the following items are configured in an AnyConnect Posture Requirement?

Select 3 answers

A.Condition

B.Operating System

C.Device ID

D.Authorization Rule

E.Remediation Action

AnswersA, B, E

Requirement links to a condition.

Why this answer

Requirements include the condition, the operating system, and the remediation action.

Practice this question →

Multi-Selecteasy

Which THREE of the following are valid remediation actions?

Select 3 answers

A.Service Remediation

B.Registry Remediation

C.VLAN Remediation

D.ACL Remediation

E.File Remediation

AnswersA, B, E

Valid remediation type.

Why this answer

File, Registry, and Service remediation are standard in Cisco ISE.

Practice this question →

MCQmedium

Which of the following is required for AnyConnect to perform posture assessment on a Mac endpoint?

A.The 'AnyConnect Compliance Module' must be installed

B.The Mac must be domain joined

C.A separate 'Posture Proxy' must be configured

D.The user must have root access

AnswerA

The module is necessary for scanning the endpoint.

Why this answer

The 'AnyConnect Compliance Module' must be deployed and configured to support macOS.

Practice this question →

MCQhard

You need to create a posture condition to verify that the 'Cisco AnyConnect' service is running. Which condition type should you select?

A.Service Condition

B.Registry Condition

C.Process Condition

D.Application Condition

AnswerA

Service conditions are designed to check if a service is running or stopped.

Why this answer

Service conditions are used to verify that specific Windows services or macOS processes are active.

Practice this question →

Multi-Selecteasy

Which TWO of the following are valid components of an ISE Posture Policy?

Select 2 answers

A.Identity Group

B.Posture Requirement

C.Authorization Policy Rule

D.Remediation Action

E.Certificate Profile

AnswersB, D

Requirements link conditions to remediation.

Why this answer

Posture policies are composed of Requirements and Remediation Actions.

Practice this question →

MCQeasy

An administrator needs to ensure that only endpoints with a specific registry key present are allowed access. Where should this posture condition be defined in Cisco ISE?

A.Administration > System > Settings > Posture

B.Policy > Policy Elements > Conditions > Authorization > Compound Condition

C.Policy > Policy Elements > Results > Posture > Remediation Actions

D.Policy > Policy Elements > Conditions > Posture > Registry Condition

AnswerD

This is the correct navigation path for defining registry-based posture conditions.

Why this answer

Registry checks are configured under Policy > Policy Elements > Conditions > Posture > Registry Condition.

Practice this question →

MCQhard

A posture condition is defined to check for a registry key, but it always returns 'Non-Compliant'. You suspect the 'Expected Value' is wrong. Where can you see what the agent actually found on the endpoint?

A.Context Visibility > Endpoints

B.Operations > Reports > Endpoints > Posture Assessment

C.Client Provisioning > Resources

D.Policy > Posture > Conditions

AnswerB

This report shows detailed scan results including actual vs expected values.

Why this answer

The 'Posture Assessment' report under Operations provides the 'Result' details, including what the agent detected versus the expected value.

Practice this question →

MCQhard

During a troubleshooting session, you notice that the AnyConnect agent is not receiving the posture policy. Which log file on the ISE Policy Service Node (PSN) should you examine?

A.prrt-server.log

B.ise-psc.log

C.guest.log

D.admin.log

AnswerB

This contains the posture service communication and policy evaluation details.

Why this answer

The 'ise-psc.log' (Policy Service Component) is the primary log for posture policy evaluation and agent communication.

Practice this question →

Multi-Selecthard

Which TWO of the following steps are required to deploy the AnyConnect posture agent?

Select 2 answers

A.Set the NAS IP address

B.Enable RADIUS Accounting

C.Create a Client Provisioning policy

D.Configure a TrustSec policy

E.Create a Client Provisioning resource

AnswersC, E

Necessary to assign the resource to the endpoint.

Why this answer

Deployment involves creating the Client Provisioning resource and then creating the policy to assign it to endpoints.

Practice this question →

MCQhard

If you want to use a script remediation, where do you define the script content?

A.In the Client Provisioning Resource file

B.In the Posture Policy XML

C.Directly in the 'Script Remediation' action in ISE

D.On the endpoint in the AnyConnect directory

AnswerC

You define the script content within the remediation action configuration.

Why this answer

Script remediation actions require you to provide the script code directly in the ISE GUI under the remediation definition.

Practice this question →

MCQmedium

Which component is responsible for triggering the posture assessment process when a user connects to the network?

A.Network Access Device (NAD)

B.AnyConnect Compliance Module

C.RADIUS Server

D.Posture Policy

AnswerD

The Posture Policy determines when and what to assess.

Why this answer

The posture requirement, when associated with a client provisioning policy, triggers the AnyConnect agent to begin assessment.

Practice this question →

Multi-Selectmedium

When troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?

Select 3 answers

A.ISE Live Logs

B.ISE Posture Reports

C.Cisco IOS syslog

D.AnyConnect VPN Gateway logs

E.AnyConnect DART bundle

AnswersA, B, E

Live logs show the authentication and authorization flows, including posture status.

Why this answer

The AnyConnect diagnostic logs, the ISE Posture reports, and the Live Logs are the primary sources of truth for investigating posture failures.

Practice this question →

Multi-Selecthard

Which THREE conditions are required for successful AnyConnect posture assessment in a wired network environment?

Select 3 answers

A.The switch must be configured for WebAuth.

B.The endpoint must have the AnyConnect agent installed.

C.The Client Provisioning service must be running on the ISE PSN.

D.An Authorization Profile configured for posture redirection must be applied.

E.The endpoint must be joined to an Active Directory domain.

AnswersB, C, D

The posture agent is the engine that executes the checks.

Why this answer

Posture requires a working authorization profile, a properly provisioned agent, and a clear communication path between the agent and the ISE Policy Services Node (PSN).

Practice this question →

MCQmedium

Which AnyConnect module is specifically required to perform posture assessment in ISE?

A.AnyConnect AMP Enabler

B.AnyConnect Compliance Module

C.AnyConnect Web Security Module

D.AnyConnect VPN Module

AnswerB

This module handles the posture assessment logic.

Why this answer

The 'AnyConnect Compliance Module' (formerly known as the posture module) is required.

Practice this question →

MCQhard

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

A.The agent automatically remediates the issue

B.The device is granted full access

C.The posture agent crashes

D.The device remains Non-Compliant

AnswerD

Without a remediation action, the state is simply reported as Non-Compliant.

Why this answer

If no remediation is defined, the device simply remains in a non-compliant state, and the authorization policy usually denies access or places it in a restricted VLAN.

Practice this question →

MCQmedium

When configuring an AnyConnect Posture Policy, which option allows the administrator to force the agent to perform a scan regardless of the current posture status?

A.Posture Type set to 'Continuos'

B.Agent Enforcement set to 'Mandatory'

C.Policy Status set to 'Production'

D.Periodic Scanning enabled in Client Provisioning Policy

AnswerB, D

Mandatory enforcement forces the agent to report and remediate compliance.

Why this answer

The 'Mandatory' setting in the Posture Requirement forces the agent to report status and remediate if necessary, whereas 'Optional' allows the user to skip.

Practice this question →

Multi-Selecteasy

Which TWO of the following are valid remediation actions available in Cisco ISE for posture compliance?

Select 2 answers

A.MAC Authentication Bypass

B.Link Remediation

C.VLAN Change

D.Downloadable ACL

E.File Remediation

AnswersB, E

Provides a URL to the user to download patches or software to fix compliance.

Why this answer

Cisco ISE supports various remediation actions including link-based (for web portals) and file-based actions to help users become compliant.

Practice this question →

MCQhard

A user is unable to pass posture assessment because the 'AnyConnect Compliance Module' is not detecting the antivirus software. Which log file on the endpoint should be reviewed to troubleshoot the compliance module's scanning logic?

A.NAC Agent Log (nac_agent.log)

B.Windows Event Viewer - Application Log

C.AnyConnect Compliance Module log (ac_ise_posture.log)

D.ISE Posture Log (ise_posture.log)

AnswerC

This is the primary log file on the Windows endpoint for troubleshooting compliance agent scan results.

Why this answer

The ACLog.txt or the Compliance Module logs (typically found in %ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\ISE Posture) contain details about scan results.

Practice this question →

MCQeasy

Which of the following is a valid remediation action type in Cisco ISE?

A.Process Kill Remediation

B.Network Remediation

C.File Remediation

D.User Prompt Remediation

AnswerC

File remediation allows for local file execution or download.

Why this answer

File, Registry, and Service remediation are standard options.

Practice this question →

Multi-Selectmedium

Which THREE of the following are valid types of Client Provisioning Resources?

Select 3 answers

A.AnyConnect Profile (XML)

B.Windows Update Agent

C.Compliance Module

D.AnyConnect Core Package

E.Antivirus definition files

AnswersA, C, D

This is a required resource.

Why this answer

Valid resources include AnyConnect packages, compliance modules, and profiles.

Practice this question →

MCQmedium

A user is compliant, but ISE still classifies the device as 'Unknown'. What is the most likely cause?

A.The posture agent failed to connect to the PSN

B.The Client Provisioning policy is misconfigured

C.The remediation action is disabled

D.The authorization rule is incorrect

AnswerA

If the agent cannot send the report, ISE keeps the status as 'Unknown'.

Why this answer

If the device is 'Unknown', it means the posture agent has not successfully sent the report to the PSN or the PSN has not updated the session state.

Practice this question →

MCQmedium

You are deploying a Posture agent using the Web Agent. Which mechanism does the Web Agent use to perform compliance checks on a Windows machine?

A.It performs deep packet inspection to determine compliance.

B.It requires the full AnyConnect VPN client to be pre-installed.

C.It communicates directly with the Microsoft Update server.

D.It relies on WMI calls initiated by the ISE server.

E.It uses a temporary ActiveX or Java component to scan the system.

AnswerE

The Web Agent relies on browser-based plugins or temporary executables to facilitate basic posture checks before full agent deployment.

Why this answer

The AnyConnect Web Agent (now referred to as the posture agent in browser-less scenarios or via the portal) uses a small temporary utility to gather information, but it is limited in scope compared to the persistent AnyConnect agent.

Practice this question →