A network administrator must use Cisco ISE to check whether endpoints have the correct version of antivirus installed Which action must be taken to allow this capability?

Cisco ISE performs endpoint posture assessment using the Cisco AnyConnect ISE Posture Module, which acts as an agent on the client machine. To enable this, an administrator must configure client provisioning policies within Cisco ISE. These policies define the deployment of the AnyConnect client and its associated modules, including the ISE Posture Module (historically called the Compliance Module). The configuration also includes posture profiles and policies that specify the checks to be performed, such as verifying the version of installed antivirus software. The agent reports the endpoint's compliance status back to ISE, which then enforces the appropriate network access policy.

A. Native supplicant profiles are used to configure 802.1X authentication settings on the endpoint, not for performing detailed posture checks that require a dedicated agent.
B. The HostScan package is a legacy component primarily associated with Cisco ASA VPN posture assessment, not the standard agent used for ISE-based network access posture.
C. The Cisco AnyConnect Network Visibility Module (NVM) is designed to collect endpoint telemetry for security analytics platforms, not to perform compliance checks for ISE posture enforcement. ---

1. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Posture" Chapter, "Cisco ISE Posture Service" section: "Posture service in Cisco ISE is a service that you can use to assess the compliance of endpoints that are connected to your network... The posture assessment is carried out by a client-side agent, which is the Cisco AnyConnect ISE Posture Agent." This document further explains that the configuration for this agent and the posture policies are created within ISE.

2. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Client Provisioning" Chapter, "Client Provisioning Policies" section: "You must configure client provisioning policies in Cisco ISE to ensure that endpoints that connect to your network have the appropriate client software installed... For example, you can configure a policy to download the Cisco AnyConnect agent, which includes the ISE Posture agent." This confirms that ISE is used to configure and push the AnyConnect agent for posture.

3. Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.10, "About the ISE Posture Module" section: "The Cisco AnyConnect ISE Posture module is the component that performs the client-side posture assessment... The ISE Posture module works with the Network Access Device (NAD) and the Cisco ISE server to determine if the endpoint is compliant with the security policies of the enterprise." This source clarifies the role of the specific AnyConnect module.