350-701 · Question #65
Which feature of Cisco ASA allows VPN users to be postured against Cisco ISE without requiring an inline posture node?
The correct answer is A. RADIUS Change of Authorization. RADIUS Change of Authorization (CoA) on Cisco ASA allows Cisco ISE to dynamically re-evaluate and update the authorization of VPN users, including applying posture policies, without needing an inline posture node.
Question
Which feature of Cisco ASA allows VPN users to be postured against Cisco ISE without requiring an inline posture node?
Options
- ARADIUS Change of Authorization
- Bdevice tracking
- CDHCP snooping
- DVLAN hopping
How the community answered
(41 responses)- A80% (33)
- B5% (2)
- C2% (1)
- D12% (5)
Why each option
RADIUS Change of Authorization (CoA) on Cisco ASA allows Cisco ISE to dynamically re-evaluate and update the authorization of VPN users, including applying posture policies, without needing an inline posture node.
RADIUS Change of Authorization (CoA) allows Cisco ISE to send a real-time message to the ASA to re-authenticate or re-authorize a VPN user after their posture status has been determined, enabling dynamic policy changes like assigning different ACLs or VLANs without an inline posture node.
Device tracking is a feature for monitoring connected devices on a network, not for enforcing posture or enabling dynamic authorization changes for VPN users.
DHCP snooping is a Layer 2 security feature that prevents rogue DHCP servers and ensures IP-to-MAC address binding integrity, unrelated to VPN posture assessment.
VLAN hopping is an attack technique to bypass VLAN isolation, not a security feature for VPN user posture or dynamic authorization.
Concept tested: Cisco ASA with ISE RADIUS CoA for VPN posture
Source: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Admin_Guide_4-0/configure-ise-nac.html
Topics
Community Discussion
No community discussion yet for this question.