Refer to the exhibit. An engineer is configuring the remote access VPN to use Cisco ISE for AAA and needs to conduct posture checks on the connecting endpoints. After the endpoint connects, it…

Question

Exhibit

Options

• AConfigure the posture authorization so it defaults to unknown status
• BFix the CoA port number
• CEnsure that authorization only mode is not enabled
• DEnable dynamic authorization within the AAA server group

• A
  5% (3)
• B
  8% (5)
• C
  12% (8)
• D
  75% (49)

Explanation

For posture assessment to function correctly with remote access VPN and Cisco ISE, Change of Authorization (CoA) must be operational. After the endpoint completes its posture compliance scan, ISE sends a CoA message to the VPN headend to re-authorize the session with the correct access level (compliant vs. non-compliant). 'Enable dynamic authorization within the AAA server group' (D) is the configuration that enables CoA on the ASA or FTD so it can accept CoA messages from ISE. Without this, ISE cannot push updated authorization after the posture check completes. Option B (CoA port) is not the root issue described. Option A (unknown posture status) is a default behavior, not a fix. Option C (authorization only mode) is a separate concern that does not directly fix CoA processing.

No community discussion yet for this question.