Implementing and Configuring Cisco Identity Services Engine (SISE)355 questions across 36 pages are complete and free, with no account or card.
355 questions in this bank
Free access · progress saved on this device
When planning for the deployment of Cisco ISE, an organization's security policy dictates that they must use network access authentication via RADIUS. It also states that the deployment needs to provide an adequate amount of security and visibility for the hosts on the network. Why should the engineer configure MAB in this situation?
Answer: D
An organization is implementing Cisco ISE posture services and must ensure that a host-based firewall is in place on every Windows and Mac computer that attempts to access the network. They have multiple vendors' firewall applications for their devices, so the engineers creating the policies are unable to use a specific application check in order to validate the posture for this. What should be done to enable this type of posture check?
Answer: B
I think B is correct. "The Firewall condition checks if a specific Firewall product is enabled on an endpoint. The list of supported Firewall products is based on the OPSWAT support charts. You can enforce policies during initial posture and Periodic Reassessment (PRA). Cisco ISE provides default Firewall conditions for Windows and macOS" https://community.cisco.com/t5/security-knowledge-base/ise-posture-prescriptive-deployment-guide/ta-p/3680273#toc-hId-1256947692
Source: Adapted from community discussion — IlPerdan0
An administrator is configuring posture with Cisco ISE and wants to check that specific services are present on the workstations that are attempting to access the network. What must be configured to accomplish this goal?
Answer: D
Table 5. OPSWAT API Versions Posture Condition Compliance Module Version OPSWAT Antivirus 3.x or earlier Antispyware 3.x or earlier Antimalware 4.x or later Disk Encryption 3.x or earlier and 4.x or later Patch Management 3.x or earlier and 4.x or later USB 4.x or later Non-OPSWAT File Any version Application Any version Compound Any version Registry Any version Service Any version https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_27_admin_guide/b_ISE_admin_27_compliance.html
Source: Adapted from community discussion — XBfoundX
A network administrator must use Cisco ISE to check whether endpoints have the correct version of antivirus installed. Which action must be taken to allow this capability?
Answer: D
ciscopress book page 637: When using posture assessment, it is critical to keep the compliance modules as up to date as possible. Many TAC cases are opened due to an endpoint failing posture checks. The remedy for such cases is simply to update the ISE and AnyConnect compliance modules because the client is running a newer version of some antivirus software, and a new compliance module is required to detect that new version correctly. Also look at ciscopress book page 642: ■AnyConnect Configuration: These configurations are built per operating system (Windows and macOS) and control what AnyConnect modules should be provisioned through the CPP and what PROFILES should be leveraged per module. ■ AnyConnect Posture Profile: This is the posture configuration for the SYSTEM SCAN MODULE, where you control all aspects of the posture module, but it is not called a configuration; rather, it is called a profile for alignment with the AnyConnect naming convention in Cisco’s ASA.
Source: Adapted from community discussion — faridh
An engineer tests Cisco ISE posture services on the network and must configure the compliance module to automatically download and install on endpoints. Which action accomplishes this task for VPN users?
Answer: D
Just for info - from SISE ebook: It is possible to do posture assessment with application access control using the Cisco Duo Security solution, and it is also possible to perform endpoint posture assessment with a Cisco ASA, using the AnyConnect HostScan module, which ties in to the ASA’s Dynamic Access Policy (DAP) engine. However, the use of the HostScan method was mostly replaced with use of the AnyConnect System Scan module with ISE for the policy server; in addition, when using Firepower Threat Defense (FTD) VPN headends, ISE is the only option for posture assessment because Host-Scan and DAP were never ported over. Cisco made the right call: Posture should be centralized from a policy server, such as ISE, and not distributed to local policy engines within each firewall. This central management ensures that an organization has a consistent posture policy that applies to all network access control methods: wired, wireless, and remote access VPNs (RA-VPNs). D is correct (CPP with ISE).
Source: Adapted from community discussion — NikoTomas
A network administrator is configuring client provisioning resource policies for client machines and must ensure that an agent pop-up is presented to the client when attempting to connect to the network. Which configuration item needs to be added to allow for this?
Answer: C
The correct answer is - the client provisioning URL in the authorization policy. To ensure that an agent pop-up is presented to the client when attempting to connect to the network, the network administrator must add the client provisioning URL to the authorization policy. This URL will specify the location of the agent that will be downloaded and installed on the client machine. Once the URL is added to the authorization policy, the network administrator must assign it to the appropriate endpoints. This can be done manually or through a dynamic assignment rule. When an endpoint connects to the network, Cisco ISE will check the endpoint's authorization status. If the endpoint is not authorized, Cisco ISE will redirect the endpoint to the client provisioning URL. The endpoint will then download and install the agent, which will present the user with a pop-up window.
Source: Adapted from community discussion — denverfly
An employee must access the internet through the corporate network from a new mobile device that does not support native supplicant provisioning provided by Cisco ISE. Which portal must the employee use to provision to the device?
Answer: A
My Devices: The My Devices portal empowers employees to add, register, and manage their personal devices, including those that do not support a native supplicant. Ref OCG. p. 168
Source: Adapted from community discussion — Cnoteone
Which two task types are included in the Cisco ISE common tasks support for TACACS+ profiles? (Choose two.)
Answer: CD
This is correct https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_device_admin.html#id_16384 In the Cisco ISE GUI, click the Menu icon () and choose Work Centers > Device Administration > Policy Elements > Results > TACACS Profiles > Add to view the common tasks settings window. The Common Task Types are Shell, WLC, Nexus, and Generic.
Source: Adapted from community discussion — iceise
An engineer is testing Cisco ISE policies in a lab environment with no support for a deployment server. In order to push supplicant profiles to the workstations for testing, firewall ports will need to be opened. From which Cisco ISE persona should this traffic be originating?
Answer: C
C is correct--the only Persona that interacts with an endpoint is Policy Service. B is not a real persona identity. PSN reviews the CPP to determine the correct NSP the supplies it to the BYOD process.
Source: Adapted from community discussion — THEODORABLE
What are two benefits of TACACS+ versus RADIUS for device administration? (Choose two.)
Answer: AE
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
300-715 practice, question 31. 355 questions available.
Version 1.0.0. How we source questions