A laptop passes posture at connection time. Hours later, the user disables the antimalware service, but the laptop keeps full network access until it reconnects the next day. Which Cisco ISE posture feature closes this gap?
Select an answer to reveal the explanation.
Short Explanation
Checking posture only at connect is like checking a driver's license once and never again, no matter what happens on the road. Periodic reassessment rechecks while you're still connected. A longer lease is the opposite fix; it trusts the old result for even longer.
Full Explanation
Posture evaluated only at connection time reflects the endpoint's state at that moment. If a user later stops the antimalware service or removes a required control, nothing changes in the network until the next authentication. Periodic reassessment in Cisco ISE instructs the posture agent to rerun the posture requirements on connected endpoints at a configured interval. If a reassessment finds the endpoint noncompliant, ISE can apply the configured action, such as continuing with a warning or moving the endpoint to restricted access through a change of authorization. That keeps access aligned with the endpoint's current state. A longer posture lease does the opposite: the lease lets ISE skip posture for a period after a compliant result, so lengthening it makes a stale result last longer. Profiling with active scanning classifies devices by their network fingerprint; it does not evaluate whether antimalware is running and does not feed posture compliance. MAC Authentication Bypass is an authentication method for devices without 802.1X; it does not evaluate software state on the laptop. Exam caveat: reassessment requires the full posture agent to remain installed, so dissolvable or agentless options cannot provide it in the same way. Operational check: enable reassessment for a test group, stop the antimalware service on a laptop, and confirm that the next reassessment reports noncompliance and changes the session's authorization.