Endpoint Compliance (10%)

SISE · 30 questions

• Posture in ISE keeps requirement definitions separate from the code that runs checks on the endpoint. A hospital wants its full-disk encryption and antivirus checks to stay current as new Windows 10 and macOS builds ship, with every requirement authored in one place inside ISE. Which source defines the posture requirements that the endpoint agent evaluates?
• A logistics company requires Windows laptops to pass a disk-encryption check before reaching the file share. Laptops missing the compliance agent must be steered to a download page, the agent then reports its result, and the live session must pick up the new policy without waiting for the next periodic reauthentication. Which posture workflow sequence applies?
• A hospital runs agent-based posture with Cisco Secure Client. Endpoints missing the mandated protection update must keep limited access for a short window while IT repairs them, users must see the repair steps, and the endpoint must be rechecked automatically once it is fixed. Which combination of posture and access settings delivers all three behaviours?
• An automotive plant turns on posture checking for its plant-floor laptops over 802.1X. Windows machines are offered the Cisco Secure Client posture module, but the handful of macOS laptops land on a provisioning page that returns a 404, since the deployment offers a package only for Windows. Which change delivers the right agent package to each operating system?
• A regional hospital must place clinical laptops on the app VLAN only when an EDR service is running and the OS patch level meets the current baseline. Laptops failing either check must be sent to a remediation page offering the EDR installer and the patch download. Which ISE posturing design produces that single pass or fail decision?
• A bank applies ISE posture to Windows and macOS laptops. Endpoints whose agent satisfies every required check reach the corporate VLAN, and endpoints whose agent reports a failed check go to a remediation VLAN. Endpoints with no agent installed or with no posture assessment completed must get that same remediation access but be flagged for an onboarding ticket. Which posture result fits that third case?
• A pharmacy chain runs 150 Windows point-of-sale terminals that already have the ISE posture agent installed. Before each terminal reaches the payment systems, three checks must all pass: the vendor agent file exists, anti-malware is current, and the required hotfix is installed. Which posture construct delivers that single all-or-nothing compliance decision?
• A company runs ISE with Secure Client deployed on every laptop. When a laptop fails the antivirus version check, security wants it restricted without bouncing the switch port, and returned to full access after reassessment passes. Which posture flow meets both requirements?
• A healthcare group requires laptops to run the corporate EDR agent and have disk encryption before touching patient systems. Machines that fail must land in a limited-access VLAN and get the missing agent installed automatically. Which posture policy design meets all four requirements?
• A regional hospital requires three posture outcomes for clinician laptops: Compliant receives full EMR access, Unknown receives a restricted VLAN with internet only, and Non-Compliant is sent to the remediation portal. Which authorization design enforces all three posture outcomes exactly as stated?
• A county government issues 400 Windows 11 laptops that are joined to the domain, and its 60 iPads must reach the same wireless network with no software installed. ISE should deliver the posture module to the laptops automatically on their first connection, and it offers the module through a provisioning step after the Access-Accept. Which factor decides which agent package an endpoint is offered?
• A plant's security team is standing up posture for 500 Windows laptops that must show full-disk encryption and current Windows security updates. They want the requirement definitions and compliance checks offered for their ISE release to be the newest published ones. Which ISE source supplies that current posture content?
• A post-production studio gates its master-footage VLAN with ISE posture. Every edit workstation must run the studio EDR with real-time scanning active; when that service stops, the editor gets a guided automatic fix and a fresh compliance check, while limited access applies until the recheck passes. Which ISE posture element performs the fix?
• A logistics firm opens its corporate WLAN to managed laptops only after a posture check passes. Laptops with disk encryption and the endpoint agent must reach full access, laptops failing a check must land in a remediation quarantine right away, and laptops whose agent stays silent must receive limited access as an unresolved case. Which posture result mapping should the policy enforce?
• A hospital requires posture checks for clinicians on the corporate WLAN. A doctor's laptop joins the SSID before anyone installs Cisco Secure Client, so the authorization rule returns a URL redirect to the client provisioning portal. The laptop installs the posture module and reports compliant, yet its session still holds the limited role from the first authentication, and clinicians need full access the moment compliance is reported. Which step completes the posture flow at this point?
• A healthcare company must check every laptop's antivirus and disk-encryption products each morning and keep ISE's support information aligned with newly published Cisco posture updates. Which component should be updated to keep that information current?
• A hospital is enabling posture for wired and wireless users. Windows and macOS laptops must be offered the Cisco Secure Client posture module after the user signs in to the provisioning portal. Which ISE policy decides which client package each endpoint receives?
• A university runs ISE posture over staff laptops and wants the posture library managed from one place. Requirement and agent definitions must refresh automatically, every policy node must serve the same definitions, and the refresh must run server-side without waiting for laptops to connect. Which Posture Work Center configuration meets all of these requirements?
• Windows laptops join the secure WLAN but only reach the remediation network, because the installer download never starts even though the session matches the rule that requires compliance. Which control decides which agent ISE offers after the session is redirected to provisioning?
• A hospital radiology laptop fails the disk-encryption posture check after a vendor driver update hides the drive from the agent. The vendor patch ships in four days, and security needs normal access for exactly that period, then an automatic return to a failed result if the check still fails. Which Posture Work Center configuration provides that time-bound behaviour?
• An insurance firm runs posture on its wired ports. Endpoints authenticate with EAP-TLS and sit on a quarantine VLAN until Secure Client reports its posture result, after which the switch must update the live session immediately without anyone reconnecting. Users report they stay quarantined until someone unplugs the cable. Which control makes ISE re-evaluate the session after the posture check passes?
• A food distributor wants three outcomes on the plant floor: laptops with current antivirus and the host firewall enabled get full access, laptops missing either one get access only to a patch server, and personal devices where no assessment agent can run get access to the update service until an admin reviews them. Which posture design maps these three results correctly?
• A manufacturer requires laptops to run the host firewall and current antivirus before opening the file share, while laptops that fail the posture check must still reach the update servers to repair themselves. Which posture policy design meets both requirements?
• A regional hospital runs ISE posture before granting clinical app access. Its posture support data is several releases old, nurses use Windows laptops, and radiology uses Macs. Both groups must pass antivirus and host firewall checks today, and the team wants ISE to recognize new product versions without manually maintaining product support data. Which step keeps ISE's posture support current?
• A hospital wants VPN posture so that fully patched laptops receive full network access, laptops with one failed check are sent to a remediation server, and devices with no posture agent still reach email only. Your policy must express all three outcomes distinctly so the help desk can tell them apart. Which posture policy structure should you configure in ISE?
• A healthcare firm's posture policy must treat a Windows laptop as compliant only when antivirus is installed, definitions are current, and real-time scanning is on. Endpoints failing any check should reach a remediation server to self-fix, while endpoints with no posture agent must stay on limited network access. Which posture requirement and action set should be configured?
• A logistics firm's posture policy must check Windows 11 laptops and macOS laptops for disk encryption and current antivirus. No device has a client yet, checks must run again after every reboot when the device reconnects, and IT allows installs only from the ISE server itself. Which client provisioning design meets these needs?
• A regional hospital is enabling ISE posture for clinicians' laptops before they reach the electronic-records VLAN. Every laptop must show a current antivirus product and full-disk encryption, and ISE must keep its list of acceptable antivirus builds current as vendors release them. Which posture configuration supplies that application data to the compliance checks?
• A defense contractor runs ISE inside a network that has no route to the internet. The posture library still checks an antivirus version the company retired two years ago, and the team wants Cisco's updated checks and rules without hand-writing them for each product. Which posture update method fits this isolated environment?
• A manufacturer wants posture on the plant WLAN. Endpoints that have yet to install the posture agent must keep limited access while they reach ISE's download portal, the assessment must actually run on the device after Secure Client installs, and ISE must re-authorize the session by CoA once the result arrives. Which posture flow sequence should be configured?