Free Implementing and Operating Cisco Security Core Technologies (SCOR 350-701 v2.0) Practice Questions

ISE posture assessment allows you to inspect the security “health” of your PC and MAC clients. This includes checking for the installation, running state, and last update for security software, such as anti-virus, anti-malware, personal firewall, and so on1. Windows service and Windows firewall are examples of such security software that can be checked by ISE posture assessment. Computer identity and user identity are not conditions that can be checked by ISE posture assessment, as they are related to authentication and authorization, not security posture. Default browser is also not a condition that can be checked by ISE posture assessment, as it is not a security software or a security risk. References: 1: Chapter 15. Device Posture Assessment - Cisco ISE for BYOD and Secure Unified Access, 3

A network administrator can transparently identify users using Active Directory on the Cisco WSA in two ways:

Create NTLM or Kerberos authentication realm and enable transparent user identification. This option allows the WSA to use the NTLM or Kerberos protocol to authenticate users without prompting them for credentials. The WSA must join the Active Directory domain and have a valid service principal name (SPN) for this option to work1.

Deploy a separate Active Directory agent such as Cisco Context Directory Agent (CDA). This option allows the WSA to receive user-to-IP mappings from the CDA, which monitors the Active Directory domain controllers for user logon events. The CDA must be installed on a Windows server and have access to the domain controllers and the WSA2.

The other options are not ways to transparently identify users using Active Directory on the Cisco WS

A.  

References := 1: User Guide for AsyncOS 11.0 for Cisco Web Security Appliances, Chapter: Acquire End-User Credentials, Topic: Active Directory/Kerberos, page 4-3. 2: User Guide for AsyncOS 11.0 for Cisco Web Security Appliances, Chapter: Acquire End-User Credentials, Topic: Active Directory Agent, page 4-5. 3: User Guide for AsyncOS 11.0 for Cisco Web Security Appliances, Chapter: Acquire End-User Credentials, Topic: eDirectory, page 4-8.

sfr {fail-open | fail-close [monitor-only]} < - There ' s a couple different options here. The first one is fail-open which means that if the Firepower software module is unavailable, the ASA will continue to forward traffic. fail-close means that if the Firepower module fails, the traffic will stop flowing. While this doesn ' t seem ideal, there might be a use case for it when securing highly regulated environments. The monitor-only switch can be used with both and basically puts the Firepower services into IDS-mode only. This might be useful for initial testing or setup.

The Cisco Identity Services Engine (ISE) posture module provides a service that allows you to check the compliance of endpoints with corporate security policies. This service consists of three main components: client provisioning, posture policy, and authorization policy. Client provisioning ensures that the endpoints receive the appropriate posture agent, such as the AnyConnect ISE Posture Agent or the Network Admission Control (NAC) Agent. Posture policy defines the conditions and requirements that the endpoints must meet to be considered compliant, such as having the latest antivirus updates or patches installed. Authorization policy determines the level of network access granted to the endpoints based on their posture assessment results, such as allowing full access, limited access, or quarantine.

The two actions that the Cisco ISE posture module provides that ensure endpoint security are:

The latest antivirus updates are applied before access is allowed. This action prevents malware infections and protects the network from potential threats. The posture policy can include predefined or custom conditions that check the antivirus status of the endpoints, such as the product name, version, definition date, and scan result. If the endpoint does not meet the antivirus requirement, the posture agent can trigger a remediation action, such as launching the antivirus update or scan, before allowing network access.

Patch management remediation is performed. This action ensures that the endpoints have the latest security patches installed and are not vulnerable to known exploits. The posture policy can include predefined or custom conditions that check the patch status of the endpoints, such as the operating system, service pack, hotfix, or update. If the endpoint does not meet the patch requirement, the posture agent can trigger a remediation action, such as redirecting the endpoint to a patch management server or launching the patch installation, before allowing network access.

References :=

Cisco Identity Services Engine Administrator Guide, Release 2.2 - Configure Client Posture Policies

Configuring posture services with the Cisco Identity Services Engine

Cisco Identity Services Engine Administrator Guide, Release 2.0 - Posture Policy

The missing global command is dot1x system-auth-control, which activates 802.1X processing on the switch. The access interfaces must also operate as Port Access Entity authenticators, so dot1x pae authenticator is required on ports connected to workstation supplicants. Cisco’s Catalyst 9300 802.1X configuration guide identifies the global command and the interface PAE role as elements of port-based authentication. Dynamic authorization supports Change of Authorization and is not required to initiate authentication. A RADIUS source interface is unnecessary when connectivity and RADIUS addressing already work. The mab command enables MAC Authentication Bypass for devices without an 802.1X supplicant; these workstations have functioning supplicants, so MAB is not the missing 802.1X control. Thus, A and C address the failure described.

================