A corporate laptop has just authenticated with 802.1X, and the posture agent has not yet reported any result to Cisco ISE. What posture status does ISE hold for the endpoint, and what access does a typical posture design give it at this point?
Select an answer to reveal the explanation.
Short Explanation
Before the agent reports, ISE honestly doesn't know, so the status is Unknown. You give that laptop a waiting room: enough access to talk to ISE, get DNS and DHCP and reach remediation, but nothing more. Assuming compliant until proven otherwise is exactly backwards.
Full Explanation
Cisco ISE tracks three main posture states for an endpoint: unknown, compliant and noncompliant. Immediately after authentication, before the posture agent has discovered ISE and reported the result of its checks, the status is unknown. A typical posture design matches the unknown state in an authorization rule that applies a limited profile, often a downloadable ACL or redirect, permitting DHCP, DNS, the ISE policy service nodes for agent discovery and provisioning, and remediation resources. Once the agent reports, ISE issues a change of authorization that moves the endpoint to the compliant or noncompliant profile. Treating an unassessed device as compliant would grant full access to endpoints that may be missing required controls, defeating the purpose of posture. Noncompliant is a result that requires an assessment, and denying all traffic would also block the agent from reaching ISE to perform that assessment. Not applicable describes endpoints with no applicable posture policy; corporate laptops are a primary posture target, not an exempt category. Exam caveat: if the agent never reports, the endpoint can remain in the unknown state, so verify agent discovery paths when devices seem stuck. Operational check: in the ISE live sessions view, confirm the endpoint shows a pending or unknown posture with the limited profile, then confirm the change after the agent reports.