Posture Policy Conditions per AD Group in Cisco ISE

Configure posture conditions and policy, and client provisioning

Answer Correct answer: C — configure a Simple Condition per AD group and reference it under the posture policy's Other Conditions so each group gets distinct compliance checks.

An engineer is configuring a posture policy for Windows 10 endpoints and wants to ensure that users in each AD group have different conditions to meet to be compliant. What must be done to accomplish this task?

Change the posture requirements to use an AD group for each use case, then use those requirements in the posture policy.
Identify the users groups needed for different policies and create service conditions to map each one to its posture requirement.
Configure a simple condition for each AD group and use it in the posture policy for each use case. Correct Answer
Use the authorization policy within the policy set to group each AD group with their respective posture policy.

Community Insight

The question tests ISE posture policy condition types, and the trap is confusing posture "service conditions" (Windows/macOS service checks) with "simple conditions" that can evaluate AD group membership.

In Cisco ISE, a posture policy's Other Conditions can reference a Simple Condition that matches AD group membership, letting each Windows 10 AD group meet a different set of compliance requirements. This page establishes why option C is the correct configuration and why service conditions are the wrong tool.

The most common wrong answer is B: "service conditions" sound like a policy-scoping mechanism, but in ISE Posture a Service Condition checks whether a Windows service or macOS daemon is running — it cannot map an AD group to a posture requirement.

Community Discussion (10 comments)

Cname 👍 1 Selected: C

The strongest point is the distinction between Simple Conditions and Service Conditions: • Simple Condition → can reference AD group membership and be used under Other Conditions in a Posture Policy. • Service Condition → checks whether a Windows service/macOS daemon is running or not. It does not mean an ISE “policy service” condition. So B is misleading because of the term service conditions.

c67983d 👍 2 Selected: C

ISE Posture Policies allow you to define "Other Conditions", including AD group membership, by referencing Simple Conditions. To make different posture checks per AD group, you: Create a Simple Condition that includes the specific AD group. Then use this in the Posture Policy as an "Other Condition" to bind the AD group to a specific set of posture requirements (e.g., AV, firewall). This is how you apply group-specific compliance rules.

Cachaman 👍 3 Selected: C

C Just tested this in my lab. You can MAP AD groups to simple conditions. Work Centers / Posture / Policy Elements / Conditions / Dictionary Simple /Simple conditions. Then you call or use the simple condition in the posture policy "Other Conditions". B does not makes sense, beacuse a Service Condition will check windows services not AD groups

NullNull88 👍 2

B, service conditions

NikoTomas 👍 4

Correct is C: "Configure a simple condition for each AD group and use it in the posture policy for each use case." --- NOT correct answers: A: “Change the posture requirements...” = this has nothing to do with AD groups, posture requirements are about conditions (firewall is running, file exists, etc...) and their expected remediation actions. B: “...create service conditions to map each one to its posture requirement” – Service Conditions? – they verifies that Win service or macOS daemon is running. Nothing to do with AD groups. D: “Use the authorization policy within the policy set...” – Authorization policy just uses posture attribute (“is compliant”), which refers to Posture policy as standalone entity, where requirements per AD group can be configured. ebook SISE: “The posture policies determine which requirements are mandatory and for whom” – i. e. NOT Authorization policy.

leostor 👍 1

Service Condition is related to the Posture....am I wrong? Service Conditions—A condition that checks if a service is running or not running on the client.

denverfly 👍 1 Selected: D

The correct answer is: Use the authorization policy within the policy set to group each AD group with their respective posture policy. The authorization policy within the policy set allows you to group different AD groups with their respective posture policies. This means that you can create a single policy set that contains all of your posture policies, and then use the authorization policy to specify which AD groups should be assigned to each posture policy.

XBfoundX 👍 2

For me in this case is B, here they are saying that each AD group have to meet different condictions to be compliant. This means that each group must have different condictions for be compliant. Btw you can do the reverse thing, you can create a policy with all the AD groups and then if they are complaint they can get access to the network (but is not reccommaned at all)

madcloud 👍 3

B is right answer. This is configured under policy ==> posture ==> posture policy. Chose identity groups and under other conditions , create service conditions

YmerG 👍 6 Selected: B

I would go for B

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

In Cisco ISE a posture policy is built from posture requirements plus optional Other Conditions, and the Other Conditions can reference Simple Conditions from the Simple dictionary. Those Simple Conditions can test identity/AD group membership, so creating one Simple Condition per AD group and calling it in the posture policy is exactly what lets each Windows 10 AD group face different compliance checks. This is option C. As Cachaman wrote after lab testing, "You can MAP AD groups to simple conditions", and NikoTomas stated flatly that "Correct is C". Cname explained the key distinction: a Simple Condition "can reference AD group membership and be used under Other Conditions in a Posture Policy." That is the supported ISE design for per-group posture differentiation.

Why the Other Options Are Wrong

Option A treats AD groups as something you put into posture requirements, but posture requirements are the checks themselves (antivirus running, file exists, registry value, etc.) and their remediation actions; they do not select users by AD group. Option B says "create service conditions to map each one", which is the trap: ISE Service Conditions are posture checks for whether a Windows service or macOS daemon is running, not a way to bind an AD group to a posture requirement. Option D moves the grouping into the authorization policy, but authorization policies evaluate posture status and assign authorization profiles; they do not define which posture conditions a given AD group must satisfy. The group-to-condition mapping belongs in the posture policy's Other Conditions, so C remains the only workable answer.

Community Comment Notes

The thread is split, but the reasoning favors C. Cachaman reported lab proof, and NikoTomas declared C correct while dismissing A and B. Cname gave the cleanest technical distinction: Simple Conditions handle AD group membership, while Service Conditions only check whether a service is running. The B voters (YmerG, madcloud, NullNull88, and XBfoundX) seem to latch onto madcloud's phrase "create service conditions" under posture policy, which misuses the term service condition. denverfly's D choice also misplaces the logic, because the authorization policy consumes posture results rather than producing per-AD-group posture conditions.

Exam Strategy

Memorize the ISE condition dictionaries: Simple Conditions can test AD group membership, while Service Conditions test service/daemon state. On exam questions about per-group posture differences, look for a Simple Condition referenced in the posture policy's Other Conditions, not a service condition or an authorization rule.

Frequently Asked Questions

Why is option B's service condition wrong for mapping AD groups to posture requirements?

A Service Condition in ISE checks whether a Windows service or macOS daemon is running; it does not evaluate AD group membership, so it cannot differentiate posture per AD group.

Where in the posture policy does the AD group Simple Condition get applied?

It is referenced under the posture policy's Other Conditions; the policy then applies its posture requirements only to endpoints whose users match that AD group condition.

More 300-715 FAQ →

Related Analysis

← Back to 300-715 Study Guide