An engineer tests Cisco ISE posture services on the network and must configure the compliance module to automatically download and install on endpoints Which action accomplishes this task for VPN users?

Cisco ISE uses Client Provisioning policies to manage the automatic deployment of agents and profiles to endpoints. For VPN users, the process involves creating a Cisco AnyConnect Configuration object within ISE that specifies which modules, such as the Posture module (compliance module), should be installed. This configuration is then associated with a Client Provisioning policy. When a VPN user connects and is redirected to ISE, this policy ensures the AnyConnect client, along with the specified posture module, is automatically downloaded and installed on the endpoint before the posture assessment process begins.

B. Posture policies are used to evaluate the compliance state of an endpoint after the agent is installed, not to perform the initial installation of the agent itself.
C. While Cisco FTD acts as the VPN gateway, the policy and software packages for client provisioning are centrally managed and served by Cisco ISE, not the FTD.
D. A posture condition is a check within a posture policy. It cannot be used to install the agent that is required to perform the posture check in the first place. ---

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Client Provisioning Policies" section.

This section states

"Client provisioning policies in Cisco ISE allow you to provision the endpoints that connect to your network with the Cisco AnyConnect agent... You can create client provisioning policies to ensure that the endpoints have the most up-to-date version of the agent and other client software." This confirms that Client Provisioning policies are the correct mechanism.

2. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Configure Cisco AnyConnect Configuration" section.

This guide details the creation of an AnyConnect configuration package

stating

"You can create an AnyConnect configuration in Cisco ISE that can be used in the client provisioning policy to deploy the AnyConnect agent." It also shows how to select specific modules

including the "AnyConnect Posture Profile."

3. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Posture Policies" section.

This documentation describes posture policies as sets of rules containing conditions and remediation actions to bring clients into compliance. It makes no mention of deploying the agent itself

reinforcing that this is not the function of a posture policy.