Mitigating MS17-010 Ransomware Risk with ISE and Patching
Configure network access control mechanisms such as 802.1X and MAB with Cisco Identity Services Engine
Describe endpoint posture assessment solutions to ensure endpoint security
Answer
Correct answer: C, E — Configure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network, and set up a well-defined endpoint patching strategy to ensure that endpoints have critical vulnerabilities patched in a timely fashion.
An engineer used a posture check on a Microsoft Windows endpoint and discovered that the MS17-010 patch was not installed, which left the endpoint vulnerable to WannaCry ransomware. Which two solutions mitigate the risk of this ransomware infection? (Choose two.)
Community Insight
The exam tests the distinction between ISE's capability to check compliance versus its inability to natively install patches without third-party integration, highlighting that checking status (C) is correct while installing (A) is technically inaccurate in this context.
This question addresses mitigating ransomware risks like WannaCry by combining Cisco Identity Services Engine (ISE) posture assessment for access control with a robust organizational patching strategy.
Many candidates select A because they assume ISE can directly remediate vulnerabilities by installing patches, confusing the role of the posture agent with external management systems like SCCM or WSUS.
Community Discussion (29 comments)
XBfoundX
👍 1
Selected: CE
https://www.cisco.com/c/en/us/td/docs/security/firepower/70/fdm/fptd-fdm-config-guide-700/fptd-fdm-sec-intel.html
XBfoundX
👍 1
Sorry DO NOT look at this link, check what I wrote there: SE is not gonna do the patching for you, ISE with the posturing module is going to decide based on the policies that you have configured, what to do, when some requirements are not fully met by the clients. In this case ISE can put those clients in a quarantine VLAN for example. After that the patch is installed, the posturing module detect the change a CoA will be sent and the client will be again in the right VLAN.
Nian
👍 1
Selected: AC
I believe A is correct - A posture policy can be made with the remediation action that redirects the user to a remediation portal where they must install the MS17-010 patch before regaining full access.
iluvmicrosoft
👍 1
anyone consider D? if your a client w tcp 445 open?? you could have been vulnerable.. file servers w tcp 445 ok.. but clients??
XvidalX
👍 4
Selected: CE
ISE does not intall patches , remediation policies does not install patches , Remediation policies does trigger installations by third party systems... A is malformed answer , C and E are totally correct
Premium_Pils
👍 1
E seems to be more logical
nep1019
👍 2
If you go look at the posture policy section of the admin guide (https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_client_posture_policies.html#task_DBFD37F536134843BC81C4DFEF34A8EC) you see that there is nothing in there that allows ISE to INSTALL a patch which is what it says for answer A). Can it be integrated with SCCM to invoke an action in SCCM to update with a patch? Yes. Can ISE itself install that patch? No. Answer is C and E.
Tuxzinator
👍 3
Selected: AC
Option C specifically addresses the vulnerability that was exploited by the WannaCry ransomware, which is the MS17-010 patch that was not installed on the endpoint. By configuring a posture policy to check that the endpoint patch level is met before allowing access to the network, the organization can ensure that all endpoints have the necessary patches installed to mitigate the risk of this ransomware. Option E is still a good solution in general to ensure that endpoints are patched in a timely fashion, but it does not specifically address the vulnerability that was exploited by the WannaCry ransomware.
psuoh
👍 2
Selected: CE
https://community.cisco.com/t5/network-access-control/ise-posture-windows-updates/td-p/3575621
psuoh
👍 1
ISE wouldn't know how to patch an Windows OS. It needs integration with some patching system.
Anonymous983475
👍 2
Selected: CE
ICE can check for patches not install them in the end user's OS
nomanlands
👍 1
A and C is correct. SCCM will integrate to do the patching as others mentioned and E is only not an option as it asks what can be done to mitigate THIS ransomware infection and not best practices overall.
west33637
👍 1
it asks what can be done to mitigate 'THE RISK' of this ransomware infection. Not to mitigate the ransomware itself. C and E mitigate the risk. ISE itself does not patch systems.
Iarn
👍 3
Selected: AC
People are saying patching isnt possible from ISE but the doco show it is configurable. https://community.cisco.com/t5/security-documents/how-to-integrate-cisco-ise-with-microsoft-sccm-for-patch/ta-p/3725035#toc-hId--2070782007 Step 1 Go to Workcentre-> Posture-> Policy Elements-> Condition-> Patch management. Add a patch management condition to check for up-to-date patch status. This conditions checks if there are any pending patches to be installed in the SCCM client.
MoII
👍 2
I'd go with A and C here.
jaciro11
👍 3
Hello TEAM, Well you want to check if a specified KB its patched in your system, okay nice the Answer is: A. Configure a posture policy in Cisco Identity Services Engine to install the MS17-010 patch before allowing access on the network. but I think the appropriate answer for this is C. Configure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network. Well that's means A and C its the same but C its more completed answer. So the answer is C and E
Steve122
👍 2
A: Patch will be installed by ISE NAC agent on endpoint C: ISE checks the endpoint first if that is compliant (NAC agent) B: Make no sense "profiling policy"
beeker98106
👍 4
A+C is correct, just confirmed
stalkr3
👍 4
confirmed by who?
jshow
👍 2
A and C for me ....question states for THIS expolit
deathfrom
👍 3
C & E for me, why would you protect against one threat when you can protect yourself from all threats?
entitty
👍 4
C&E ISE cannot natively install patches - Need integration
Fabi777
👍 1
Why not B and C...after all is with profiling policies that we decide what info to get from an endpoint device...
Kris92
👍 3
I would go for CE, patching could be done by agent, but not by ISE.
jimmyjose
👍 5
Cisco ISE posture policy works in the following manner. 1. ISE checks if the system meets all pre-requisites (like host-based firewall and antivirus health) 2. ONLY if all pre-requisites are met, is the system granted access to the network. 3. If all pre-requisites are not met, the system is assigned an IP address from a quarantined network with basic network, from where, remediation is performed. Remediation involves firewall service start, antivirus service start, and antivirus definitions update in this example. Hence, answer is A and C.
Monnezzo
👍 10
It's A and C source: https://community.cisco.com/t5/security-documents/how-to-integrate-cisco-ise-with-microsoft-sccm-for-patch/ta-p/3725035#toc-hId--2070782007
nep1019
👍 1
Disagree. Your link says that ISE only sees that SCCM shows that there are patches needed. It then uses AnyConnect to trigger SCCM to install the patch. Answer A specifically states that ISE installs the patch. There is nowhere in any guide that says ISE installs a patch. Further if you look at the posture policy section of the admin guide, it says nothing about pushing patches. Answer A mentions the configuring a posture policy.
Sorel
👍 26
I'm struggling to find a good link on this, but seems to me that ISE will not patch an endpoint by himself, instead it relies on WSUS for this. So, A is probably incorect, and the right answer is CE. Anyone else?
bigdadzzz
👍 2
https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010110.html
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is correct because Cisco ISE Posture evaluates the endpoint's health, including patch levels, against defined policies before granting network access. If the MS17-010 patch is missing, the endpoint fails the posture check and is denied full access. Option E is correct because proactive patch management is the primary defense against known exploits like WannaCry; ensuring timely patching removes the vulnerability entirely.Why the Other Options Are Wrong
Option A is incorrect because Cisco ISE does not natively install operating system patches itself. While it can trigger remediation workflows, the actual installation relies on third-party tools like Microsoft SCCM or WSUS. Describing ISE as installing the patch directly is a common misconception. Option B is incorrect because profiling identifies device types (e.g., iPhone vs. Windows PC), whereas posture checks verify security compliance (e.g., antivirus status, patches). Option D is incorrect because relying solely on firewall policies to stop replication is insufficient compared to eliminating the vulnerability via patching and preventing infected devices from joining the network via posture checks.Community Comment Notes
Community consensus strongly favors C and E. Several commenters noted that ISE cannot natively install patches, stating "ISE does not intall patches" and clarifying that remediation triggers third-party systems. One user highlighted that while some documentation shows integration possibilities, the direct action of 'installing' is attributed to external tools, making C and E the most accurate choices for mitigation strategies.Exam Strategy
Always distinguish between 'checking/compliance' and 'remediation/installation' when dealing with ISE Posture. For multi-select questions involving security controls, look for the combination of technical enforcement (access control) and administrative process (patching policy).
Frequently Asked Questions
Can Cisco ISE directly install OS patches like MS17-010?
No, ISE does not natively install OS patches. It integrates with third-party solutions like SCCM or WSUS to trigger remediation, but the installation itself is handled by those tools.
What is the difference between ISE Profiling and Posture?
Profiling identifies the type of device (e.g., printer, laptop) based on traffic characteristics. Posture assesses the security state of the device (e.g., AV status, patch level) to determine if it meets access policies.