Passed Exam Today 350-701

The Cisco Identity Services Engine (ISE) posture module provides several actions that ensure endpoint security. Two of these actions are:

• Assignments to endpoint groups are made dynamically, based on endpoint attributes. This means that ISE can assign endpoints to different identity groups or roles, depending on the results of the posture assessment. For example, ISE can assign an endpoint to a compliant group if it meets all the posture requirements, or to a quarantine group if it fails the posture assessment. This allows ISE to enforce granular access policies based on the endpoint’s posture status and attributes, such as operating system, device type, location, etc.
• The latest antivirus updates are applied before access is allowed. This means that ISE can check if the endpoint has the most recent antivirus definitions installed, and if not, it can remediate the endpoint by applying the latest updates. This ensures that the endpoint is protected from the latest malware threats and vulnerabilities, and reduces the risk of infection and compromise.

References:

• Cisco Identity Services Engine Administrator Guide, Release 2.2, Configure Client Posture Policies
• Configuring Posture Policies, Antivirus Compound Condition
• Which two actions does the Cisco Identity Services Engine posture module provide that ensures endpoint security?

In a remote access VPN configuration, dynamic split tunneling allows traffic to certain trusted domains to bypass the VPN tunnel and exit through the client's local internet gateway. This feature selectively directs only the necessary traffic over the VPN, while allowing direct internet access for specific domains or traffic deemed safe or trusted, optimizing bandwidth and performance for remote users.

Cisco ISE uses probes to collect endpoint attributes that are used in profiling. Probes are software modules that run on the ISE Policy Service Nodes (PSNs) and gather information about the endpoints connected to the network. Probes can use various protocols and methods to collect endpoint attributes, such as RADIUS, DHCP, SNMP, HTTP, DNS, NetFlow, NMAP, Active Directory, and Cisco pxGrid. The collected attributes are then matched to predefined or custom conditions that define the endpoint profiles. Endpoint profiling enables ISE to identify and classify the endpoints and apply the appropriate policies based on their identity, role, and context12. References: 1: Cisco ISE 2.4 Endpoint Profiling - Cisco 2: How To Create an Endpoint Profile - Cisco Community

Cisco Umbrella is a cloud-delivered security service that protects users from malicious domains and IPs, regardless of their location or network. When users are off the corporate network, they can use the Cisco Umbrella roaming client, which is embedded in the Cisco AnyConnect client, to enforce Umbrella DNS servers for all DNS queries. This way, Umbrella can block requests to malicious or unwanted domains before a connection is ever made, and provide visibility and protection for users anywhere they go. The Umbrella roaming client does not require any additional agents or end user action, and it can work with or without a VPN connection. References := Cisco Umbrella Roaming, Umbrella Roaming Client – How it Works on Your Company Network