The security team wants endpoint flow records that show, for each network connection, which process on the laptop generated it and which user was logged in, including while the laptop is off the corporate network. Which Cisco Secure Client capability provides this?
Select an answer to reveal the explanation.
Short Explanation
A switch sees packets go by, but it can't see which program on the laptop sent them. The Network Visibility Module sits on the endpoint, so it knows the process, the user and the flow, and it can hold onto that data when you're off the network. The trap is expecting switch NetFlow to know process names.
Full Explanation
The Network Visibility Module in Cisco Secure Client collects flow information on the endpoint itself and enriches each flow with context that only the host has: the process name and hash that opened the connection, its parent process, the logged-in user and device details. Because it runs on the laptop, it can cache records while the device is off the trusted network and export them when it returns, according to its profile, to a collector such as a SIEM or analytics platform. That delivers the process-to-connection and user-to-connection mapping the team wants. The ISE Posture module evaluates compliance requirements and reports results to ISE; it does not produce flow records for every connection. Split tunneling in the VPN module decides which traffic goes through the tunnel and which goes directly; it is not a flow-logging feature and does not record process names. NetFlow on an access switch exports flow data based on packet headers seen by the switch, so it cannot identify the endpoint process, and it sees nothing when the laptop is away from the campus. Exam caveat: collection and export behavior is controlled by the module's profile, including trusted network detection and data anonymization options. Operational check: generate traffic from a known application on a test laptop and confirm that the collector shows flows with that process name and the logged-in user.