Courseiva

CCNA Endpoint Compliance Questions

35 questions · Endpoint Compliance · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

You need to allow users to remediate a non-compliant status manually. Which feature allows them to 'retry' the posture check after they have fixed the issue?

A.A remediation link that triggers a command
B.Re-scan button in the AnyConnect agent UI
C.A periodic re-scan timer in the posture policy
D.Re-authentication via the 802.1X supplicant
AnswerB

The Re-scan button in the AnyConnect agent UI lets users trigger an on-demand posture reassessment after remediating their device, without waiting for the next periodic check. This directly satisfies the stem's requirement to manually retry the posture check, immediately updating compliance status against the ISE policy.

Why this answer

The Re-scan button in the AnyConnect agent UI allows users to manually trigger a posture re-assessment after they have remediated the issue. This button is available in the AnyConnect posture module interface, enabling users to retry the posture check without waiting for a periodic scan or re-authenticating. It is the feature designed for manual remediation retry.

Exam trap

SISE often tests the difference between manual and automatic remediation — candidates may pick periodic re-scan or re-authentication, but the question specifically asks for a feature that allows users to manually retry, which is the Re-scan button in AnyConnect.

How to eliminate wrong answers

Option A is wrong because a remediation link that triggers a command is an automated action, not a user-initiated retry — it does not allow the user to manually re-scan. Option C is wrong because a periodic re-scan timer automatically re-scans at set intervals, but it does not give the user manual control to retry immediately. Option D is wrong because re-authentication via the 802.1X supplicant would restart the entire network access process, not just the posture check, and is not a manual retry feature.

Practice this question →
2
MCQmedium

You need to ensure that the AnyConnect posture agent is updated automatically. Where is this configured?

A.Posture Policy > Settings
B.Posture Requirements
C.Remediation Actions
D.Client Provisioning Policy
AnswerD

The Client Provisioning Policy defines which AnyConnect modules and posture components are pushed to endpoints, including automatic updates of the posture agent. Configuring it there satisfies the requirement for automatic agent updates without manual user intervention.

Why this answer

The Client Provisioning Policy in Cisco ISE determines which software (such as the AnyConnect posture agent) is provisioned to endpoints and how it is updated. To ensure the AnyConnect posture agent is updated automatically, you configure the Client Provisioning Policy to point to the latest AnyConnect package and enable automatic upgrades. This policy controls the provisioning and update behavior.

Exam trap

SISE often tests where agent updates are configured — candidates may pick Posture Policy or Remediation Actions, but the correct location is Client Provisioning Policy, which handles software provisioning and upgrades.

How to eliminate wrong answers

Option A is wrong because Posture Policy > Settings contains general posture settings like remediation timers and grace periods, not agent update configuration. Option B is wrong because Posture Requirements define compliance conditions, not agent provisioning or updates. Option C is wrong because Remediation Actions define what happens when an endpoint is non-compliant, not how the agent is updated.

Practice this question →
3
MCQeasy

What is the effect of setting a Posture Requirement to 'Optional'?

A.The agent only checks when requested by the user
B.The agent will not perform the check at all
C.The user can choose to bypass the check without being blocked
D.The device is automatically granted access
AnswerC

Setting a Posture Requirement to 'Optional' means the endpoint is not blocked when the check fails or is skipped; the user may proceed without remediation. It differs from 'Mandatory', which enforces compliance before granting access.

Why this answer

Setting a posture requirement to 'Optional' means the check is still evaluated and reported, but the user is not blocked if it fails — they can choose to continue without remediation. This is used for monitoring or gradual rollout rather than enforcement.

Exam trap

SISE often tests the difference between Optional and Disabled posture requirements, and candidates incorrectly assume Optional means the check is skipped or that access is automatically granted.

How to eliminate wrong answers

Option A is wrong because 'Optional' does not make the check user-triggered; the agent still performs the check automatically, it just does not enforce it. Option B is wrong because 'Optional' does not disable the check — that would be a 'Disabled' or 'Not Used' setting, and the check still runs and reports compliance status. Option D is wrong because 'Optional' does not automatically grant access; the device still goes through authorization, and the result simply does not block the user, which is different from being auto-authorized.

Practice this question →
4
Multi-Selecthard

Which TWO of the following represent ways to verify the posture status of an endpoint?

Select 2 answers
A.Check the DHCP server logs
B.View the status in the AnyConnect agent UI
C.Review the switch port configuration
D.Analyze the AAA traffic dump
E.Check the Posture Assessment Report on ISE
AnswersB, E

The AnyConnect agent UI displays the endpoint's current posture state, including which checks passed or failed, giving local verification on the device itself. This satisfies the stem's requirement for a valid method of confirming posture status without querying ISE server-side reporting.

Why this answer

Option B is correct because the Cisco AnyConnect (Secure Client) agent UI displays the endpoint's posture status directly, showing whether the system has passed or failed the posture policy checks performed by the agent in conjunction with ISE. Option E is correct because ISE's Posture Assessment Report provides a centralized view of posture results, including compliance details for each endpoint that has undergone posture evaluation. Option A is incorrect because DHCP server logs only record IP address lease assignments and contain no posture or compliance information.

Option C is incorrect because switch port configuration defines Layer 2 settings such as VLANs, trunking, and port security, not endpoint posture state. Option D is incorrect because an AAA traffic dump captures RADIUS authentication and authorization exchanges but does not present a usable posture status verification view.

Exam trap

SISE often tests the distinction between direct posture verification methods (agent UI, ISE reports) and indirect network data (DHCP logs, switch configs, AAA dumps), so candidates may incorrectly choose options that seem related to network access but do not directly show posture compliance.

Practice this question →
5
MCQmedium

Which posture condition should be used to ensure a specific Windows patch (KB number) is installed?

A.Registry Condition
B.Application Condition
C.File Condition
D.Patch Condition
AnswerD

A patch condition checks for a specific installed update by its KB number, directly satisfying the requirement to verify that exact Windows patch. Unlike OS-version or file conditions, it queries the update inventory, so only endpoints with that KB installed match the policy.

Why this answer

A Patch Condition in ISE posture is specifically designed to check for the presence of a particular Windows patch by its KB number (or a range of KBs). It queries the endpoint's update history and compares it against the configured KB values, returning compliant or non-compliant. This is the only condition type that directly targets patch-level granularity.

Exam trap

SISE often tests whether candidates know that patch verification is a dedicated condition type (Patch Condition) rather than being achieved through registry or file checks, which are common but indirect workarounds.

How to eliminate wrong answers

Option A is wrong because a Registry Condition checks for the existence or value of a specific registry key, which is useful for many things but not a direct KB check. Option B is wrong because an Application Condition checks whether a specific application is installed and its version, not OS patches. Option C is wrong because a File Condition checks for the presence, date, or version of a file on disk, which is unrelated to patch installation.

Practice this question →
6
MCQmedium

You are configuring a Posture policy in Cisco ISE and need to ensure that endpoints running an outdated version of Windows are directed to a specific remediation portal. Which component must you configure to define the conditions that trigger this remediation?

A.Posture Requirements
B.Client Provisioning Policies
C.Remediation Actions
D.Posture Policies
AnswerA

Posture Requirements define the specific checks, such as OS version, that an endpoint must satisfy. Configuring a requirement for the minimum Windows version makes non-compliant endpoints fail the check and be directed to the remediation portal, satisfying the stated condition.

Why this answer

Posture Requirements in Cisco ISE define the specific conditions that an endpoint must meet to be considered compliant, such as a particular Windows version or patch level. When an endpoint fails to meet a requirement, ISE can trigger a remediation action. The requirement itself contains the condition (e.g., 'Windows version must be at least 10.0.19041') that, when not met, leads to remediation.

Therefore, Posture Requirements is the component that defines the conditions triggering remediation.

Exam trap

The trap is confusing Posture Requirements (the condition) with Remediation Actions (the action) — candidates often pick Remediation Actions because the question mentions 'remediation portal', but the portal is the action, not the condition.

How to eliminate wrong answers

Option B is wrong because Client Provisioning Policies determine which software (like AnyConnect or a remediation client) is provisioned to an endpoint, not the conditions that trigger remediation. Option C is wrong because Remediation Actions define what action to take (e.g., link to a portal, run a script) but do not define the condition that triggers them — they are the 'then' part, not the 'if' part. Option D is wrong because Posture Policies are the higher-level policies that bind posture requirements to endpoint identity groups and define the overall compliance flow, but the specific condition that triggers remediation is defined within the Posture Requirement itself.

Practice this question →
7
MCQeasy

When deploying the AnyConnect Posture agent, which specific file must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment?

A.AnyConnect Diagnostic and Reporting Tool
B.AnyConnect ISE Posture Agent profile
C.AnyConnect Compliance Module
D.AnyConnect VPN package
AnswerC

The AnyConnect Compliance Module supplies the posture plugins that ISE pushes to endpoints, enabling the agent to perform posture assessment. Uploading it to Client Provisioning satisfies the stem's requirement, since the AnyConnect package alone cannot evaluate endpoint compliance conditions.

Why this answer

The AnyConnect Compliance Module is the specific file that must be uploaded to the Cisco ISE Client Provisioning portal to enable posture assessment. It contains the posture policies and checks that the AnyConnect ISE Posture Agent uses to evaluate endpoint compliance. Without this module, the agent cannot perform posture checks, so it is essential for posture assessment.

Exam trap

SISE often tests the confusion between the AnyConnect Compliance Module and the AnyConnect ISE Posture Agent profile, as both are related to posture but serve different purposes: the profile configures the agent, while the Compliance Module provides the actual posture checks.

How to eliminate wrong answers

Option A is wrong because the AnyConnect Diagnostic and Reporting Tool (DART) is used for troubleshooting and collecting logs, not for posture assessment. Option B is wrong because the AnyConnect ISE Posture Agent profile is a configuration profile that defines how the agent behaves, but it does not contain the actual posture checks; the Compliance Module is required for that. Option D is wrong because the AnyConnect VPN package provides VPN functionality, not posture assessment; it is used for remote access, not compliance checking.

Practice this question →
8
MCQhard

A user is complaining that they are stuck in a posture remediation loop despite having the latest antivirus software installed. You verify that the AV check is correctly configured. What is the most likely cause for this behavior?

A.The ISE server is in maintenance mode.
B.The AnyConnect Compliance Module is outdated on the endpoint.
C.The Posture Policy is disabled.
D.The Authorization policy uses the wrong group.
E.The Remediation action requires a reboot that hasn't occurred.
AnswerB

The Compliance Module supplies the posture condition definitions and remediation logic AnyConnect uses. An outdated module cannot correctly evaluate the installed antivirus, so ISE keeps returning the same failed condition and the endpoint loops through remediation despite compliant AV.

Why this answer

The AnyConnect Compliance Module (also called the Posture Module) is responsible for performing posture checks on the endpoint, including antivirus, firewall, and OS patch verification. If the module is outdated, it may not correctly report the AV status to ISE, causing the endpoint to appear non-compliant and triggering a remediation loop even though the AV software is current.

Exam trap

SISE often tests posture troubleshooting — candidates assume the AV software itself is the problem, but the actual issue is frequently the AnyConnect Compliance Module being outdated and unable to correctly report AV status.

How to eliminate wrong answers

Option A is wrong because if the ISE server were in maintenance mode, posture checks would fail entirely for all users, not just one user in a remediation loop. Option C is wrong because a disabled Posture Policy would result in no posture check being performed at all, not a remediation loop. Option D is wrong because a wrong group in the Authorization policy would result in incorrect access permissions, not a posture remediation loop.

Option E is wrong because while a pending reboot can cause posture failures, the question specifies the AV check is correctly configured and the AV is up to date — the most likely cause is the compliance module itself being outdated, which is a known issue.

Practice this question →
9
MCQeasy

What is the purpose of the 'Posture Discovery' phase?

A.To verify the user credentials
B.To remediate non-compliant endpoints
C.To identify if posture is required for the session
D.To determine if the endpoint is compliant
AnswerC

Posture Discovery determines whether the endpoint requires posture assessment at all, based on operating system, agent presence and matching policy conditions. It precedes any compliance check, so its specific role is deciding if posture applies to the session rather than evaluating or remediating the endpoint.

Why this answer

Posture Discovery is the phase where ISE determines whether posture assessment is required for the session at all. It evaluates the authorization policy and posture policy to decide if the endpoint should be posture-checked, and if so, which posture policy applies. It does not itself verify compliance or remediate — it only decides whether posture is in scope.

Exam trap

SISE often tests the distinction between 'is posture required?' (Discovery) and 'is the endpoint compliant?' (Assessment), so candidates who pick 'determine if the endpoint is compliant' confuse the two phases.

How to eliminate wrong answers

Option A is wrong because verifying user credentials is the authentication phase (802.1X/MAB with an identity store), not posture discovery. Option B is wrong because remediation happens after a posture assessment finds the endpoint non-compliant, which is a later phase. Option D is wrong because determining compliance is the posture assessment/evaluation phase, which occurs after discovery confirms posture is required.

Practice this question →
10
MCQhard

A security team wants to ensure that endpoints connecting via VPN are compliant with the latest antivirus definitions. They configure a posture policy that checks for the antivirus definition date to be within the last 7 days. However, some endpoints with up-to-date antivirus are still marked Non-Compliant. The administrator suspects that the posture condition is not evaluating correctly. Which component should be checked to verify that the antivirus definition date is being read correctly by the AnyConnect Posture module?

A.The endpoint's operating system language settings, which can affect how the antivirus definition date is formatted and read.
B.The posture condition's file check configuration, which specifies the path to the antivirus definition file and the date format.
C.The AnyConnect Posture module's version, because older versions may not support reading date-based conditions.
D.The ISE Policy Service Node's certificate used for posture communication, as an expired certificate would cause inaccurate results.
AnswerB

Antivirus definition dates are often checked using file conditions that examine the last modified date or a specific file's version. If the file path or date format is incorrect, the condition may fail even when definitions are current. Verifying the file check configuration ensures the agent reads the correct file and interprets the date properly. This is the most likely cause given the symptoms.

Why this answer

When posture conditions check for antivirus definition dates, they often rely on file conditions that examine file metadata such as last modified date or version. If the specified file path or the expected date format does not match the actual file, the condition will incorrectly fail. Reviewing the file check configuration ensures the agent reads the correct data and applies the correct logic.

Exam trap

The trap here is blaming communication or version issues when the problem is specific to how a file-based condition interprets date information, which is a common misconfiguration.

Practice this question →
11
MCQmedium

Which protocol is used by the AnyConnect agent to communicate posture information to the ISE Policy Service Node (PSN)?

A.RADIUS
B.HTTP/HTTPS (TCP 8905)
C.DNS
D.SNMP
AnswerB

AnyConnect sends posture data to the ISE PSN over HTTP/HTTPS on TCP 8905, satisfying the requirement for a dedicated posture transport channel. Unlike RADIUS, which carries authentication and authorisation, this separate TCP session handles endpoint posture assessment traffic exclusively, allowing the agent to report compliance details directly to the PSN.

Why this answer

The AnyConnect (now Secure Client) posture module communicates with the ISE Policy Service Node over HTTPS on TCP port 8905, using the ISE posture agent protocol. RADIUS is used only for the initial 802.1X/MAB authentication and authorization, not for ongoing posture data exchange. The posture agent sends posture assessment results (AVC, AS, etc.) to the PSN via this HTTPS channel, and the PSN returns the compliance decision.

Exam trap

SISE often tests the port/protocol pairing for posture — candidates assume RADIUS carries posture data because it carries auth, but posture uses HTTPS/8905, a distinct channel.

How to eliminate wrong answers

Option A is wrong because RADIUS carries authentication, authorization, and accounting attributes — it does not transport posture assessment payloads from the endpoint agent to ISE. Option C is wrong because DNS is only used for name resolution of the PSN FQDN, not for posture data transport. Option D is wrong because SNMP is a network management protocol for polling devices and traps, not for endpoint posture reporting.

Practice this question →
12
MCQeasy

Which of the following is a posture requirement setting that defines how often the agent performs a re-scan?

A.Periodic Scanning Interval
B.Re-assessment Frequency
C.Scan Timeout
D.Policy Update Interval
AnswerA

Periodic Scanning Interval is the posture requirement that governs re-scan frequency, defining the elapsed time between successive agent posture assessments. It directly satisfies the stem's constraint of specifying how often the agent re-scans, rather than what conditions must pass or how remediation behaves.

Why this answer

The Periodic Scanning Interval is the specific posture requirement setting in Cisco ISE that controls how frequently the endpoint agent (e.g., Cisco AnyConnect ISE Posture module) performs a posture re-scan. It defines the time interval between automatic posture reassessments, ensuring that endpoints remain compliant with security policies throughout the session. This setting is configured within the posture policy under 'Periodic Reassessment' and directly answers the question of how often the agent re-scans.

Exam trap

SISE often tests the distinction between posture reassessment timing and other posture-related timers, such as scan timeout or policy update interval, causing candidates to confuse the purpose of each setting.

How to eliminate wrong answers

Option B is wrong because 'Re-assessment Frequency' is not a recognized setting name in Cisco ISE posture policies; it is a generic term that may describe the concept but does not match the actual configuration parameter. Option C is wrong because 'Scan Timeout' defines the maximum time allowed for a posture scan to complete before it is considered failed, not the interval between scans. Option D is wrong because 'Policy Update Interval' controls how often the agent downloads updated posture policies from ISE, not how often it performs a re-scan of the endpoint's compliance status.

Practice this question →
13
MCQmedium

You are creating a File Requirement for posture assessment. What is the required behavior if you want to confirm that a specific file exists on the client machine?

A.Set the Check type to 'Exists' and provide the full file path.
B.Set the Check type to 'Status' and provide the service name.
C.Set the Check type to 'Registry' and provide the key path.
D.Set the Check type to 'Version' and provide the file size.
E.Set the Check type to 'Content' and provide the file hash.
AnswerA

Setting the Check type to 'Exists' makes the posture condition evaluate file presence rather than content, version or hash. Supplying the full path lets the client agent locate the exact file, satisfying the requirement to confirm existence.

Why this answer

In Cisco ISE posture policy, a File Requirement is used to check for the presence, version, or content of a file on the endpoint. To simply confirm that a specific file exists, the Check type must be set to 'Exists' and the full file path (e.g., C:\Program Files\App\app.exe) must be provided. ISE then uses the AnyConnect/Stealthwatch posture agent to verify the file's presence and returns Compliant or Non-Compliant.

Exam trap

SISE often tests the mapping between posture Check types and their required inputs — candidates confuse 'Exists' (file path) with 'Version' (file version) or 'Status' (service name), picking the wrong check type for the stated goal.

How to eliminate wrong answers

Option B is wrong because 'Status' check type is used to verify whether a Windows service is running, started, or stopped — it requires a service name, not a file path. Option C is wrong because 'Registry' check type inspects a registry key or value, not a file on disk. Option D is wrong because 'Version' checks the file version number (or file version attributes), not file size, and it is used when a specific version is required.

Option E is wrong because 'Content' check type validates file contents against a hash or string, which is overkill for simply confirming existence.

Practice this question →
14
MCQhard

When configuring an 'Application Condition' to check for a specific version of an application, which operator is required to ensure the version is at least '10.5.0'?

A.Matches
B.Greater Than or Equal
C.Equals
D.Contains
AnswerB

Greater Than or Equal compares the detected application version numerically against the threshold, so any build at or above 10.5.0 satisfies the condition. This directly meets the stem's "at least" constraint, whereas Greater Than alone would wrongly exclude version 10.5.0 itself.

Why this answer

The 'Greater Than or Equal' operator is the only one that evaluates a version comparison numerically, allowing the condition to match any version at or above 10.5.0 (e.g., 10.5.1, 10.6.0, 11.0.0). This is required when the goal is a minimum version threshold rather than an exact match.

Exam trap

SISE often tests operator selection for version checks, and the trap is choosing 'Equals' or 'Matches' when the requirement is a minimum version threshold, which would incorrectly fail newer versions.

How to eliminate wrong answers

Option A is wrong because 'Matches' is used for pattern/regex matching of strings, not for numeric version comparison, so it cannot enforce a minimum version. Option C is wrong because 'Equals' only matches the exact version 10.5.0 and would fail for 10.5.1 or 10.6.0, which also satisfy the 'at least' requirement. Option D is wrong because 'Contains' performs substring matching and would incorrectly match versions like 110.5.0 or 10.5.0-beta, and it does not understand version semantics.

Practice this question →
15
Multi-Selectmedium

Which TWO of the following are prerequisites for the AnyConnect posture agent to function?

Select 2 answers
A.Administrative rights on the server
B.Connectivity to the ISE PSN
C.A pre-installed VPN tunnel
D.A supported operating system
E.A static IP address on the endpoint
AnswersB, D

Posture assessment requires the agent to reach an ISE Policy Service Node to submit posture data and receive the access decision. Without PSN connectivity, the agent cannot complete posture evaluation, so the endpoint fails authorisation. This prerequisite directly satisfies the scenario's requirement for the AnyConnect posture agent to function.

Why this answer

Option B is correct because the AnyConnect posture agent must reach an ISE Policy Services Node (PSN) to send posture assessment data and receive the posture decision (via the posture discovery and posture-report flow over HTTPS/port 8443), so connectivity to the ISE PSN is a prerequisite. Option D is correct because the posture agent is only supported on specific operating systems (for example, supported versions of Windows, macOS, and Linux) and will not function on an unsupported OS. Option A is not required because administrative rights on the server are not needed for the endpoint posture agent to operate.

Option C is not required because the posture agent does not depend on a pre-installed VPN tunnel; posture can be evaluated before or independently of tunnel establishment. Option E is not required because the endpoint can use DHCP and does not need a static IP address for posture to work.

Exam trap

The trap is confusing agent prerequisites with ISE server requirements, leading candidates to select administrative rights or VPN tunnel.

Practice this question →
16
Multi-Selecteasy

Which TWO of the following are true about Monitor Mode?

Select 2 answers
A.It requires user intervention
B.It logs posture results for analysis
C.It blocks traffic for non-compliant devices
D.It automatically fixes compliance issues
E.It allows network access for non-compliant endpoints
AnswersB, E

Monitor Mode evaluates endpoints against posture conditions but only records the outcome, writing compliance and non-compliance results to ISE reports. This satisfies the scenario's need for visibility without enforcement, letting administrators analyse posture data before enabling closed-mode blocking.

Why this answer

Option B is correct because Monitor Mode in posture assessment (e.g., Cisco ISE or similar NAC solutions) records and logs the posture results of endpoints without enforcing any action, allowing administrators to analyze compliance data before enabling enforcement. Option E is correct because, in Monitor Mode, non-compliant endpoints are still granted network access since no enforcement policy is applied; the mode is purely observational. Option A is incorrect because Monitor Mode operates automatically once configured, requiring no per-session user intervention.

Option C is incorrect because blocking traffic for non-compliant devices is characteristic of Enforcement Mode, not Monitor Mode. Option D is incorrect because automatically fixing compliance issues (remediation) is a separate function, often part of remediation or enforcement workflows, not Monitor Mode itself.

Exam trap

The trap is confusing Monitor Mode with Enforcement Mode; candidates often think Monitor Mode blocks non-compliant devices, but it only logs and allows.

Practice this question →
17
MCQhard

In a high-availability environment, where should the posture agent point to ensure it always reaches a PSN for assessment?

A.The FQDN of the Load Balancer VIP
B.The local gateway address
C.The IP address of the ISE Admin Node
D.A single static IP of the Primary PSN
AnswerA

Pointing the posture agent at the load balancer's FQDN lets it resolve to the VIP, which distributes assessment traffic across available PSNs. This satisfies the high-availability constraint, since a single PSN address would fail if that node became unavailable.

Why this answer

The posture agent should point to the FQDN of the Load Balancer VIP to ensure it always reaches a PSN for assessment. In a high-availability environment, using a load balancer VIP provides a single, resilient endpoint that distributes requests across multiple PSNs. This avoids single points of failure and ensures that if one PSN goes down, the agent can still reach another PSN via the VIP.

Exam trap

SISE often tests the confusion between using a load balancer VIP and a specific PSN IP. Candidates may choose a static PSN IP for simplicity, but that defeats high availability.

How to eliminate wrong answers

Option B is wrong because the local gateway address is not a PSN and does not provide posture assessment services. Option C is wrong because the ISE Admin Node (PAN) is not used for posture assessment; PSNs handle posture. Option D is wrong because a single static IP of the Primary PSN does not provide high availability; if that PSN fails, the agent cannot reach another PSN.

Practice this question →
18
MCQeasy

What is the primary function of the 'Monitor Mode' in Cisco ISE Posture policies?

A.To gather compliance data without restricting network access
B.To automatically remediate endpoints
C.To bypass the posture check entirely
D.To block all traffic until the agent is installed
AnswerA

Monitor Mode collects endpoint compliance data while leaving network access unrestricted, satisfying the stem's requirement for visibility without enforcement. Unlike enforcement mode, which applies remediation or restricts access based on posture results, Monitor Mode only audits and reports, letting administrators assess posture compliance before rolling out enforcement.

Why this answer

In Cisco ISE Posture policies, Monitor Mode is used to assess endpoint compliance without restricting network access. The endpoint is allowed on the network, but posture data is collected and logged. This allows administrators to see compliance status without impacting users, making option A correct.

Exam trap

The trap is assuming Monitor Mode means no posture check occurs, when it actually performs the check but does not enforce the result.

How to eliminate wrong answers

Option B is wrong because automatic remediation is not performed in Monitor Mode; remediation requires enforcement. Option C is wrong because Monitor Mode does not bypass the posture check; it still performs the check but does not enforce. Option D is wrong because blocking all traffic is enforcement, not monitoring.

Practice this question →
19
MCQeasy

Where do you upload the AnyConnect posture agent packages to make them available for Client Provisioning?

A.Operations > Troubleshoot > Client Provisioning
B.Policy > Policy Elements > Results > Client Provisioning > Resources
C.Policy > Posture > Policy
D.Administration > System > Settings > Posture
AnswerB

AnyConnect posture agent packages are uploaded as Client Provisioning resources under Policy > Policy Elements > Results > Client Provisioning > Resources. From there they are referenced by client provisioning policies and pushed to endpoints during onboarding.

Why this answer

AnyConnect posture agent packages are uploaded in ISE under Policy > Policy Elements > Results > Client Provisioning > Resources. This is where administrators add agent resources (such as AnyConnect .pkg or .msi files) and compliance modules, which are then referenced by Client Provisioning policies to be pushed to endpoints.

Exam trap

SISE often tests the exact navigation path for uploading resources — candidates confuse the Client Provisioning Resources page with Posture Policy or global Posture Settings, leading to wrong menu selections.

How to eliminate wrong answers

Option A is wrong because Operations > Troubleshoot > Client Provisioning is for troubleshooting and diagnostics of provisioning events, not for uploading resources. Option C is wrong because Policy > Posture > Policy defines posture conditions and requirements, not the agent packages themselves. Option D is wrong because Administration > System > Settings > Posture contains global posture settings (like posture general settings and remediation), not the resource repository for agent packages.

Practice this question →
20
MCQeasy

A network administrator is configuring posture remediation for Windows endpoints that fail a check for Windows Defender real-time protection. The administrator wants to provide users with a link to enable real-time protection manually. Which remediation type should be configured in the posture policy to achieve this?

A.Application
B.File
C.Link
D.Script
AnswerC

A Link remediation action provides a clickable URL that users can follow to perform a manual remediation step, such as enabling Windows Defender real-time protection. This is ideal when the remediation cannot be automated or when the administrator wants to guide users to a specific resource. It does not require scripting or file distribution.

Why this answer

The Link remediation type is designed to present users with a URL they can click to access instructions or a resource for manual remediation. In this scenario, the administrator wants users to manually enable real-time protection, so providing a link to a help page or a direct setting is the correct approach. It is the simplest and most direct method for guiding users.

Exam trap

The trap here is confusing remediation types that automate actions (Script, File, Application) with those that guide users (Link), when the requirement is for manual user action.

Practice this question →
21
MCQmedium

You are configuring a posture policy for Windows endpoints. Which component must be configured to provide users with a link to download the required compliance software if the posture check fails?

A.Post-Posture Authorization Rule
B.Client Provisioning Policy
C.File Remediation Action
D.Posture Requirement
AnswerC

A File Remediation Action specifies the download link and instructions presented to the user when a posture check fails, satisfying the requirement to supply compliance software. Other remediation types, such as Windows or Antivirus actions, trigger local updates rather than offering a downloadable installer.

Why this answer

A File Remediation Action in Cisco ISE is specifically designed to provide users with a downloadable link or instructions to obtain the required compliance software when a posture check fails. It is the remediation component that bridges the gap between a failed posture condition and the user's ability to fix it.

Exam trap

The trap is confusing the posture requirement (the condition to check) with the remediation action (the fix provided) — candidates often pick 'Posture Requirement' when the question asks about delivering software to the user.

How to eliminate wrong answers

Option A is wrong because a Post-Posture Authorization Rule determines what access a user gets after posture evaluation, not how to deliver remediation software. Option B is wrong because a Client Provisioning Policy controls which posture agent or supplicant is installed on the endpoint, not the remediation link for failed compliance. Option D is wrong because a Posture Requirement defines the condition that must be met (e.g., antivirus enabled), not the remediation action taken when it fails.

Practice this question →
22
MCQmedium

Which of the following is required for AnyConnect to perform posture assessment on a Mac endpoint?

A.The 'AnyConnect Compliance Module' must be installed
B.The Mac must be domain joined
C.A separate 'Posture Proxy' must be configured
D.The user must have root access
AnswerA

The Compliance Module supplies the posture agents that inspect a Mac endpoint's antivirus, firewall and disk-encryption state, then return that data to the headend for policy evaluation. Without it, AnyConnect can establish the VPN tunnel but cannot collect the compliance attributes posture assessment requires.

Why this answer

The AnyConnect Compliance Module is required on a Mac endpoint to perform posture assessment. It provides the posture agents that check endpoint compliance with policies such as antivirus, firewall, and OS version.

Exam trap

SISE often tests whether candidates assume posture requires domain join or root access, when the actual requirement is the AnyConnect Compliance Module and proper posture profile configuration.

How to eliminate wrong answers

Option B is wrong because domain join is not required for posture assessment on Mac; posture checks are agent-based and do not depend on Active Directory membership. Option C is wrong because there is no separate 'Posture Proxy' component in AnyConnect; posture is performed by the Compliance Module. Option D is wrong because root access is not required for posture assessment; the AnyConnect client runs with sufficient privileges to perform checks.

Practice this question →
23
MCQhard

You need to create a posture condition to verify that the 'Cisco AnyConnect' service is running. Which condition type should you select?

A.Service Condition
B.Registry Condition
C.Process Condition
D.Application Condition
AnswerA

A Service Condition inspects the endpoint's running services and processes via the posture agent, matching the named 'Cisco AnyConnect' service. It directly satisfies the requirement to verify that specific service is running, unlike file, registry or application conditions.

Why this answer

In Cisco ISE posture conditions, a Service Condition is used to check whether a specific service (such as the Cisco AnyConnect service) is running on the endpoint. This condition type queries the endpoint's service status via the posture agent and returns a compliant or non-compliant result based on whether the service is active. It is the correct choice for verifying that a named service is running.

Exam trap

SISE often tests the distinction between Service, Process, and Application conditions — candidates frequently confuse a running service with a running process, but AnyConnect is a service, not just a process.

How to eliminate wrong answers

Option B is wrong because a Registry Condition checks for the presence or value of a specific Windows registry key, not a running service. Option C is wrong because a Process Condition checks for a running process by executable name, which is different from a Windows service — AnyConnect runs as a service, not just a process. Option D is wrong because an Application Condition checks for installed applications (via Add/Remove Programs or similar), not whether a service is currently running.

Practice this question →
24
Multi-Selecteasy

Which TWO of the following are valid components of an ISE Posture Policy?

Select 2 answers
A.Identity Group
B.Posture Requirement
C.Authorization Policy Rule
D.Remediation Action
E.Certificate Profile
AnswersB, D

A Posture Requirement defines the condition an endpoint must satisfy, such as an antivirus definition age or OS patch level, and is evaluated during posture assessment. It is a genuine policy component, distinct from remediation, which fixes failures, and from discovery, which decides whether posture applies.

Why this answer

In Cisco ISE, a Posture Policy is built from two core configurable components: Posture Requirements (option B), which define the conditions a client must satisfy (for example, an antivirus definition age or a specific registry/file check via the posture condition), and Remediation Actions (option D), which specify what ISE does when a requirement fails, such as showing a remediation message, linking to a download, or applying a restricted authorization result. These two elements are exactly what the posture policy editor lets you add per operating system and per posture condition, so B and D are the valid components. Option A (Identity Group) is a condition used in authorization or authentication policies, not a posture policy component.

Option C (Authorization Policy Rule) is a separate policy set element that consumes posture status (e.g., Posture_Status = Compliant) but is not itself part of the posture policy. Option E (Certificate Profile) is used for certificate-based authentication and BYOD/trust operations, not for defining posture checks or remediation.

Exam trap

SISE often tests the distinction between components of Posture Policy versus Authorization Policy, causing candidates to confuse Identity Groups or Authorization Policy Rules as part of Posture Policy.

Practice this question →
25
MCQeasy

An administrator needs to ensure that only endpoints with a specific registry key present are allowed access. Where should this posture condition be defined in Cisco ISE?

A.Administration > System > Settings > Posture
B.Policy > Policy Elements > Conditions > Authorization > Compound Condition
C.Policy > Policy Elements > Results > Posture > Remediation Actions
D.Policy > Policy Elements > Conditions > Posture > Registry Condition
AnswerD

Registry conditions are posture policy elements, so they are authored under Policy Elements before being referenced in posture policies. Defining the specific registry key here lets ISE evaluate endpoint compliance and grant access only to matching endpoints.

Why this answer

Posture conditions, such as checking for a specific registry key, are defined under Policy > Policy Elements > Conditions > Posture > Registry Condition. This allows you to create a condition that evaluates the presence of a registry key on the endpoint, which can then be used in posture policies.

Exam trap

SISE often tests the exact location of posture condition definitions, and candidates may confuse them with authorization conditions or remediation actions.

How to eliminate wrong answers

Option A is wrong because Administration > System > Settings > Posture contains global posture settings, not individual condition definitions. Option B is wrong because Authorization Compound Conditions are used for authorization policies, not posture conditions. Option C is wrong because Remediation Actions define what actions to take when a condition fails, not the condition itself.

Practice this question →
26
MCQhard

A posture condition is defined to check for a registry key, but it always returns 'Non-Compliant'. You suspect the 'Expected Value' is wrong. Where can you see what the agent actually found on the endpoint?

A.Context Visibility > Endpoints
B.Operations > Reports > Endpoints > Posture Assessment
C.Client Provisioning > Resources
D.Policy > Posture > Conditions
AnswerB

The Posture Assessment report under Operations > Reports > Endpoints displays the actual values the agent evaluated against each posture condition, letting you compare the endpoint's real registry data with the configured Expected Value and identify the mismatch.

Why this answer

The Operations > Reports > Endpoints > Posture Assessment report provides detailed information about posture assessments, including the actual values found on the endpoint for each condition. This allows you to compare the expected value with what the agent reported, helping to diagnose why a condition is returning Non-Compliant.

Exam trap

The trap is confusing where to find posture assessment details. Candidates might think Context Visibility shows the actual values, but it only shows compliance status. The detailed actual values are in the Posture Assessment report.

How to eliminate wrong answers

Option A is wrong because Context Visibility > Endpoints shows endpoint attributes and compliance status but does not provide the detailed posture condition results, such as the actual registry key value. Option C is wrong because Client Provisioning > Resources is for managing client provisioning resources like profiles and agents, not for viewing posture assessment details. Option D is wrong because Policy > Posture > Conditions is where you define the posture conditions, not where you view the results of assessments.

Practice this question →
27
MCQmedium

A network administrator has deployed Cisco ISE with AnyConnect posture. Windows endpoints must run Windows Defender and have real-time protection enabled to be considered compliant. The administrator configures a posture policy with a Windows Defender condition that checks the service status. However, endpoints where Defender is running but real-time protection is disabled are still reported as compliant. What is the most likely cause?

A.The AnyConnect posture module is not installed on the endpoints, so no posture data is collected.
B.The posture policy is set to audit mode, which allows non-compliant endpoints to appear compliant.
C.The Windows Defender firewall is blocking the posture communication between AnyConnect and ISE.
D.The posture condition only checks whether the Windows Defender service is running, not the real-time protection status.
AnswerD

The condition likely verifies the service state (e.g., service exists and is running) but does not evaluate the real-time protection setting. To enforce real-time protection, the condition must check the specific registry key or use a file condition that reflects that setting. Since endpoints with real-time protection disabled still pass, the condition is too shallow.

Why this answer

The condition checks only the service status, not the real-time protection setting. To enforce real-time protection, the condition must evaluate the specific registry key or use a file condition that reflects that setting. The other options would cause different symptoms, such as Unknown status or complete posture failure, not a false Compliant result.

Exam trap

The trap here is assuming that checking the Windows Defender service status is sufficient to verify real-time protection, when in fact the service can be running while real-time protection is disabled.

Practice this question →
28
Multi-Selecthard

Which TWO of the following steps are required to deploy the AnyConnect posture agent?

Select 2 answers
A.Set the NAS IP address
B.Enable RADIUS Accounting
C.Create a Client Provisioning policy
D.Configure a TrustSec policy
E.Create a Client Provisioning resource
AnswersC, E

A Client Provisioning policy defines which provisioning resource ISE presents to matching endpoints, so it is required to deliver the AnyConnect posture agent. Without it, no download or installation is offered, so the agent cannot be deployed.

Why this answer

Option C (Create a Client Provisioning policy) is correct because the Client Provisioning policy is what binds the posture requirements and the AnyConnect package to the matching conditions (OS, posture status, etc.) so that ISE can tell the endpoint which agent and profile to download. Option E (Create a Client Provisioning resource) is correct because the resource is the actual AnyConnect package/profile (or other agent) that ISE delivers to the endpoint; without a resource there is nothing for the policy to provision. Option A (Set the NAS IP address) is not required for posture agent deployment; the NAS IP is used in RADIUS/AAA device configuration and does not provision the agent.

Option B (Enable RADIUS Accounting) is not required for deploying the posture agent; accounting is for session logging/accounting records, not for agent provisioning. Option D (Configure a TrustSec policy) is not required for posture agent deployment; TrustSec handles security group tagging/SGACL enforcement, which is separate from provisioning the AnyConnect posture module.

Exam trap

SISE often tests the specific steps for client provisioning, and candidates may confuse it with other ISE features like TrustSec or RADIUS accounting. The trap is selecting steps that are not directly related to provisioning the agent.

Practice this question →
29
MCQmedium

An administrator configures a posture policy that checks for a specific Windows registry key with an expected value of '1'. After deployment, endpoints that have the key correctly set to '1' are still reported as Non-Compliant. The AnyConnect Posture module is installed and the agent is communicating with ISE. Which action should the administrator take first to resolve this issue?

A.Change the posture policy to use a file condition instead of a registry condition, as file checks are more reliable.
B.Reinstall the AnyConnect Posture module on the affected endpoints to ensure the latest version is used.
C.Restart the Cisco ISE Policy Service Node to clear any cached posture results that might be stale.
D.Verify that the registry condition is using the correct operator, such as 'Exists' or 'Equals', and that the expected value matches the data type.
AnswerD

Registry conditions in posture policies require an operator that matches the check's intent. If the condition uses an operator like 'Exists' but expects a specific value, or if the expected value is a string '1' but the registry stores a DWORD, the condition fails. Reviewing the operator and data type is the first logical step because the agent is communicating and the key is present, so the mismatch likely lies in the condition definition.

Why this answer

The endpoints are communicating and the registry key is present, so the failure likely stems from a misconfigured condition. Registry conditions require an operator that matches the check (e.g., 'Exists', 'Equals') and an expected value that matches the registry data type (e.g., DWORD, String). Verifying these settings is the most direct troubleshooting step before considering more invasive actions.

Exam trap

The trap here is assuming that a communicating agent means the posture condition is correctly defined, when often the issue is a mismatch between the operator, expected value, and actual registry data type.

Practice this question →
30
MCQhard

If you want to use a script remediation, where do you define the script content?

A.In the Client Provisioning Resource file
B.In the Posture Policy XML
C.Directly in the 'Script Remediation' action in ISE
D.On the endpoint in the AnyConnect directory
AnswerC

Script remediation content is entered directly within the Script Remediation action in ISE, where the script body is defined and executed on the endpoint. No external repository or file reference is required for this action type.

Why this answer

In Cisco ISE, when configuring a posture policy with a script remediation action, the script content is defined directly within the 'Script Remediation' action itself. This allows the administrator to embed the script that will be executed on the endpoint to remediate the non-compliance.

Exam trap

The trap is assuming that the script content is stored in a separate file or resource. Candidates might think it's in the Client Provisioning Resource or the Posture Policy XML, but it's actually embedded in the remediation action configuration.

How to eliminate wrong answers

Option A is wrong because the Client Provisioning Resource file is used to define the posture agent and profiles, not the remediation script content. Option B is wrong because the Posture Policy XML defines the policy conditions and actions, but the script content is not defined there; it references the remediation action. Option D is wrong because the AnyConnect directory on the endpoint is where the agent resides, but the script content is not defined there; it is pushed from ISE.

Practice this question →
31
Multi-Selectmedium

When troubleshooting AnyConnect posture issues, which THREE logs or files are most useful for determining why a compliance check failed?

Select 3 answers
A.ISE Live Logs
B.ISE Posture Reports
C.Cisco IOS syslog
D.AnyConnect VPN Gateway logs
E.AnyConnect DART bundle
AnswersA, B, E

ISE Live Logs show the authentication and authorisation decisions plus posture condition results for each session. They reveal which compliance check failed and the resulting authorisation profile, making them the primary troubleshooting source for posture failures.

Why this answer

ISE Live Logs (A) are the primary real-time troubleshooting tool because they show the posture policy evaluation, the exact posture condition that failed, and the authorization result for the session as it happens. ISE Posture Reports (B) aggregate posture compliance data and show which posture policies and conditions are failing across endpoints, which helps confirm the specific compliance check that caused the failure. The AnyConnect DART bundle (E) collects the client-side posture logs, including the Posture Agent (cscan/ISEPosture) and compliance module logs, which reveal why the endpoint's posture assessment failed on the client.

Cisco IOS syslog (C) only records router/switch events and does not contain posture policy evaluation details, and AnyConnect VPN Gateway logs (D) cover tunnel establishment and connection events rather than the posture compliance decision made by ISE.

Exam trap

The trap is selecting VPN gateway or IOS syslog as posture troubleshooting sources — candidates confuse VPN connectivity logs with posture compliance logs, which are separate subsystems.

Practice this question →
32
MCQmedium

Which AnyConnect module is specifically required to perform posture assessment in ISE?

A.AnyConnect AMP Enabler
B.AnyConnect Compliance Module
C.AnyConnect Web Security Module
D.AnyConnect VPN Module
AnswerB

The AnyConnect Compliance Module performs the actual posture assessment on the endpoint, collecting attributes such as antivirus status and OS patches. Without it, ISE receives no posture data, so the Compliance Module is the specific component required for posture evaluation.

Why this answer

The AnyConnect Compliance Module is the component that performs posture assessment on the endpoint. It collects information about the device's security state (e.g., antivirus, firewall, OS patches) and reports it to ISE for policy evaluation.

Exam trap

The trap is confusing the Compliance Module with other AnyConnect modules like AMP Enabler or Web Security; the exam expects you to know that posture assessment specifically requires the Compliance Module.

How to eliminate wrong answers

Option A is wrong because AMP Enabler is for deploying Advanced Malware Protection, not posture. Option C is wrong because Web Security Module provides web filtering, not posture assessment. Option D is wrong because VPN Module is for establishing VPN connections, not posture.

Practice this question →
33
MCQhard

In a posture flow, what happens if an endpoint is determined to be 'Non-Compliant' but no remediation action is configured?

A.The agent automatically remediates the issue
B.The device is granted full access
C.The posture agent crashes
D.The device remains Non-Compliant
AnswerD

Posture evaluation records the endpoint's compliance state independently of remediation. Without a configured remediation action, no corrective step is triggered, so the device simply stays in the Non-Compliant state and remains subject to whatever authorisation result that status produces.

Why this answer

If an endpoint is determined to be Non-Compliant and no remediation action is configured, the device remains Non-Compliant. The posture policy will not automatically remediate or grant full access; the status persists until remediation is applied or the policy changes. Thus, option D is correct.

Exam trap

The trap is thinking that ISE automatically remediates or grants access when no remediation is configured, but the status simply remains non-compliant.

How to eliminate wrong answers

Option A is wrong because automatic remediation requires a configured remediation action; without it, no remediation occurs. Option B is wrong because granting full access would violate the posture policy; non-compliant devices are typically restricted. Option C is wrong because the posture agent does not crash due to missing remediation; it simply reports the status.

Practice this question →
34
Multi-Selectmedium

Which THREE of the following are valid types of Client Provisioning Resources?

Select 3 answers
A.AnyConnect Profile (XML)
B.Windows Update Agent
C.Compliance Module
D.AnyConnect Core Package
E.Antivirus definition files
AnswersA, C, D

AnyConnect Profile (XML) is a valid Client Provisioning Resource in ISE, delivering VPN client profiles and settings to endpoints. It satisfies the stem's requirement by being one of the recognised resource types alongside agent packages and compliance modules used for provisioning.

Why this answer

In Cisco ISE Client Provisioning, the valid Client Provisioning Resource types include the AnyConnect Profile (XML), which delivers an XML configuration profile that defines VPN, posture, and connection settings to the AnyConnect client, so option A is correct. The Compliance Module is also a valid resource type, as it supplies the posture assessment components (such as OPSWAT libraries) that the AnyConnect posture agent uses to evaluate endpoint compliance, making option C correct. The AnyConnect Core Package is likewise a valid Client Provisioning Resource, since it is the actual AnyConnect client installer package provisioned to endpoints, so option D is correct.

Option B (Windows Update Agent) is not a Client Provisioning Resource type in ISE, and option E (Antivirus definition files) is not provisioned as a client provisioning resource either, as antivirus definitions are handled by the AV vendor rather than ISE client provisioning.

Exam trap

SISE often tests the distinction between Client Provisioning Resources and Posture Conditions/Remediations, causing candidates to mistakenly select items like Windows Update Agent or Antivirus definition files, which are used for posture assessment but are not provisioned as resources.

Practice this question →
35
MCQmedium

You are deploying a Posture agent using the Web Agent. Which mechanism does the Web Agent use to perform compliance checks on a Windows machine?

A.It performs deep packet inspection to determine compliance.
B.It requires the full AnyConnect VPN client to be pre-installed.
C.It communicates directly with the Microsoft Update server.
D.It relies on WMI calls initiated by the ISE server.
E.It uses a temporary ActiveX or Java component to scan the system.
AnswerE

The Web Agent performs posture checks by downloading a temporary ActiveX or Java component that runs locally to inspect the Windows endpoint, satisfying the requirement for compliance assessment without a persistent agent. This browser-based mechanism enables the Web Agent to evaluate device state directly, which is precisely how it fulfils the scenario's posture-check constraint.

Why this answer

The Cisco ISE Web Agent is a clientless posture solution that uses a temporary ActiveX control (for Internet Explorer) or Java applet (for other browsers) to perform posture checks on Windows machines. This component is downloaded and executed within the browser session to gather endpoint information such as antivirus status, OS patches, and registry settings. Once the compliance assessment is complete, the temporary component is removed, leaving no persistent software on the endpoint.

Exam trap

SISE often tests the misconception that the Web Agent requires the AnyConnect client or performs deep packet inspection, when in fact it relies on temporary browser components like ActiveX or Java.

How to eliminate wrong answers

Option A is wrong because deep packet inspection is a network-based technique used by firewalls and IPS systems, not by the Web Agent for endpoint compliance; the Web Agent requires host-based data. Option B is wrong because the Web Agent is specifically designed for clientless posture and does not require the full AnyConnect VPN client; that would be the AnyConnect posture module. Option C is wrong because the Web Agent does not communicate directly with Microsoft Update servers; it collects local system information and sends it to ISE for evaluation.

Option D is wrong because WMI calls are not initiated by the ISE server; the Web Agent runs on the endpoint and may use WMI locally, but the server does not remotely initiate WMI calls for posture.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Endpoint Compliance questions.

Start 20-question session