Mitigating MS17-010 Ransomware Risk with ISE and Patching

350-701 By islever Editorial Last updated

Configure network access control mechanisms such as 802.1X and MAB with Cisco Identity Services Engine Describe endpoint posture assessment solutions to ensure endpoint security

Short answer

CE Configure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network, and set up a well-defined endpoint patching strategy to ensure that endpoints have critical vulnerabilities patched in a timely fashion.

Question

An engineer used a posture check on a Microsoft Windows endpoint and discovered that the MS17-010 patch was not installed, which left the endpoint vulnerable
to WannaCry ransomware.
Which two solutions mitigate the risk of this ransomware infection? (Choose two.)
  1. Configure a posture policy in Cisco Identity Services Engine to install the MS17-010 patch before allowing access on the network.
  2. Set up a profiling policy in Cisco Identity Services Engine to check an endpoint patch level before allowing access on the network.
  3. Configure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network. Correct Answer
  4. Configure endpoint firewall policies to stop the exploit traffic from being allowed to run and replicate throughout the network.
  5. Set up a well-defined endpoint patching strategy to ensure that endpoints have critical vulnerabilities patched in a timely fashion. Correct Answer

Key Takeaways

The exam tests the distinction between ISE's capability to check compliance versus its inability to natively install patches without third-party integration, highlighting that checking status (C) is correct while installing (A) is technically inaccurate in this context.

This question addresses mitigating ransomware risks like WannaCry by combining Cisco Identity Services Engine (ISE) posture assessment for access control with a robust organizational patching strategy.

Common mistake: Many candidates select A because they assume ISE can directly remediate vulnerabilities by installing patches, confusing the role of the posture agent with external management systems like SCCM or WSUS.

Expert Analysis

Why the Answer Is Correct

Option C is correct because Cisco ISE Posture evaluates the endpoint's health, including patch levels, against defined policies before granting network access. If the MS17-010 patch is missing, the endpoint fails the posture check and is denied full access. Option E is correct because proactive patch management is the primary defense against known exploits like WannaCry; ensuring timely patching removes the vulnerability entirely.

Why the Other Options Are Wrong

Option A is incorrect because Cisco ISE does not natively install operating system patches itself. While it can trigger remediation workflows, the actual installation relies on third-party tools like Microsoft SCCM or WSUS. Describing ISE as installing the patch directly is a common misconception. Option B is incorrect because profiling identifies device types (e.g., iPhone vs. Windows PC), whereas posture checks verify security compliance (e.g., antivirus status, patches). Option D is incorrect because relying solely on firewall policies to stop replication is insufficient compared to eliminating the vulnerability via patching and preventing infected devices from joining the network via posture checks.

Community Comment Notes

Community consensus strongly favors C and E. Several commenters noted that ISE cannot natively install patches, stating "ISE does not intall patches" and clarifying that remediation triggers third-party systems. One user highlighted that while some documentation shows integration possibilities, the direct action of 'installing' is attributed to external tools, making C and E the most accurate choices for mitigation strategies.

Exam Strategy

Always distinguish between 'checking/compliance' and 'remediation/installation' when dealing with ISE Posture. For multi-select questions involving security controls, look for the combination of technical enforcement (access control) and administrative process (patching policy).

Frequently Asked Questions

Can Cisco ISE directly install OS patches like MS17-010?

No, ISE does not natively install OS patches. It integrates with third-party solutions like SCCM or WSUS to trigger remediation, but the installation itself is handled by those tools.

What is the difference between ISE Profiling and Posture?

Profiling identifies the type of device (e.g., printer, laptop) based on traffic characteristics. Posture assesses the security state of the device (e.g., AV status, patch level) to determine if it meets access policies.

More 350-701 FAQ →

Discussion 29 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 29

  1. Sorel 👍 26
    I'm struggling to find a good link on this, but seems to me that ISE will not patch an endpoint by himself, instead it relies on WSUS for this. So, A is probably incorect, and the right answer is CE. Anyone else?
  2. Monnezzo 👍 10
    It's A and C source: https://community.cisco.com/t5/security-documents/how-to-integrate-cisco-ise-with-microsoft-sccm-for-patch/ta-p/3725035#toc-hId--2070782007
  3. jimmyjose 👍 5
    Cisco ISE posture policy works in the following manner. 1. ISE checks if the system meets all pre-requisites (like host-based firewall and antivirus health) 2. ONLY if all pre-requisites are met, is the system granted access to the network. 3. If all pre-requisites are not met, the system is assigned an IP address from a quarantined network with basic network, from where, remediation is performed. Remediation involves firewall service start, antivirus service start, and antivirus definitions update in this example. Hence, answer is A and C.
  4. XvidalX 👍 4
    ISE does not intall patches , remediation policies does not install patches , Remediation policies does trigger installations by third party systems... A is malformed answer , C and E are totally correct
  5. entitty 👍 4
    C&E ISE cannot natively install patches - Need integration
Show 24 more comments
  1. beeker98106 👍 4
    A+C is correct, just confirmed
  2. stalkr3 👍 4
    confirmed by who?
  3. Tuxzinator 👍 3
    Option C specifically addresses the vulnerability that was exploited by the WannaCry ransomware, which is the MS17-010 patch that was not installed on the endpoint. By configuring a posture policy to check that the endpoint patch level is met before allowing access to the network, the organization can ensure that all endpoints have the necessary patches installed to mitigate the risk of this ransomware. Option E is still a good solution in general to ensure that endpoints are patched in a timely fashion, but it does not specifically address the vulnerability that was exploited by the WannaCry ransomware.
  4. jaciro11 👍 3
    Hello TEAM, Well you want to check if a specified KB its patched in your system, okay nice the Answer is: A. Configure a posture policy in Cisco Identity Services Engine to install the MS17-010 patch before allowing access on the network. but I think the appropriate answer for this is C. Configure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network. Well that's means A and C its the same but C its more completed answer. So the answer is C and E
  5. Iarn 👍 3
    People are saying patching isnt possible from ISE but the doco show it is configurable. https://community.cisco.com/t5/security-documents/how-to-integrate-cisco-ise-with-microsoft-sccm-for-patch/ta-p/3725035#toc-hId--2070782007 Step 1 Go to Workcentre-> Posture-> Policy Elements-> Condition-> Patch management. Add a patch management condition to check for up-to-date patch status. This conditions checks if there are any pending patches to be installed in the SCCM client.
  6. deathfrom 👍 3
    C & E for me, why would you protect against one threat when you can protect yourself from all threats?
  7. Kris92 👍 3
    I would go for CE, patching could be done by agent, but not by ISE.
  8. nep1019 👍 2
    If you go look at the posture policy section of the admin guide (https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_client_posture_policies.html#task_DBFD37F536134843BC81C4DFEF34A8EC) you see that there is nothing in there that allows ISE to INSTALL a patch which is what it says for answer A). Can it be integrated with SCCM to invoke an action in SCCM to update with a patch? Yes. Can ISE itself install that patch? No. Answer is C and E.
  9. Steve122 👍 2
    A: Patch will be installed by ISE NAC agent on endpoint C: ISE checks the endpoint first if that is compliant (NAC agent) B: Make no sense "profiling policy"
  10. bigdadzzz 👍 2
    https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010110.html
  11. psuoh 👍 2
    https://community.cisco.com/t5/network-access-control/ise-posture-windows-updates/td-p/3575621
  12. Anonymous983475 👍 2
    ICE can check for patches not install them in the end user's OS
  13. jshow 👍 2
    A and C for me ....question states for THIS expolit
  14. MoII 👍 2
    I'd go with A and C here.
  15. XBfoundX 👍 1
    Sorry DO NOT look at this link, check what I wrote there: SE is not gonna do the patching for you, ISE with the posturing module is going to decide based on the policies that you have configured, what to do, when some requirements are not fully met by the clients. In this case ISE can put those clients in a quarantine VLAN for example. After that the patch is installed, the posturing module detect the change a CoA will be sent and the client will be again in the right VLAN.
  16. nep1019 👍 1
    Disagree. Your link says that ISE only sees that SCCM shows that there are patches needed. It then uses AnyConnect to trigger SCCM to install the patch. Answer A specifically states that ISE installs the patch. There is nowhere in any guide that says ISE installs a patch. Further if you look at the posture policy section of the admin guide, it says nothing about pushing patches. Answer A mentions the configuring a posture policy.
  17. nomanlands 👍 1
    A and C is correct. SCCM will integrate to do the patching as others mentioned and E is only not an option as it asks what can be done to mitigate THIS ransomware infection and not best practices overall.
  18. Nian 👍 1
    I believe A is correct - A posture policy can be made with the remediation action that redirects the user to a remediation portal where they must install the MS17-010 patch before regaining full access.
  19. west33637 👍 1
    it asks what can be done to mitigate 'THE RISK' of this ransomware infection. Not to mitigate the ransomware itself. C and E mitigate the risk. ISE itself does not patch systems.
  20. iluvmicrosoft 👍 1
    anyone consider D? if your a client w tcp 445 open?? you could have been vulnerable.. file servers w tcp 445 ok.. but clients??
  21. XBfoundX 👍 1
    https://www.cisco.com/c/en/us/td/docs/security/firepower/70/fdm/fptd-fdm-config-guide-700/fptd-fdm-sec-intel.html
  22. Fabi777 👍 1
    Why not B and C...after all is with profiling policies that we decide what info to get from an endpoint device...
  23. psuoh 👍 1
    ISE wouldn't know how to patch an Windows OS. It needs integration with some patching system.
  24. Premium_Pils 👍 1
    E seems to be more logical

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide