To enforce endpoint compliance before granting network access, a Network Access Control (NAC) solution is required. Cisco Identity Services Engine (ISE) is Cisco's NAC platform that authenticates and authorizes users and devices. The Cisco AnyConnect Posture module is an agent installed on the endpoint that collects detailed system information, such as the operating system version, patch levels, and the presence and status of applications like antivirus software. This information is sent to ISE, which compares it against pre-defined posture policies. If the endpoint is compliant (e.g., has the correct AV and OS build), ISE grants the appropriate level of network access.

B. Cisco Stealthwatch and Cisco Identity Services Engine integration: This integration is for post-admission threat detection and response. Stealthwatch analyzes network traffic to find anomalies and can instruct ISE to quarantine a compromised device, but it does not perform pre-admission compliance checks.
C. Cisco ASA firewall with Dynamic Access Policies configured: Dynamic Access Policies (DAP) are primarily used for VPN access control on an ASA firewall. While they offer some endpoint assessment, they are less comprehensive and scalable than the dedicated posture services in ISE for general network access.
D. Cisco Identity Services Engine with PxGrid services enabled: PxGrid (Platform Exchange Grid) is a framework for sharing security context between ISE and other systems. While essential for ecosystem integration, PxGrid itself does not perform the endpoint posture assessment; it only shares the results gathered by other components.

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Posture Services" section: "Cisco ISE posture service is a process that you can use to ensure that all the endpoints that are accessing your network are compliant with the security policies of your organization... The posture agent that runs on the endpoint reports the posture status of the client to Cisco ISE." (Reference: Chapter: Configure Posture Policies and Client Provisioning)

2. Cisco AnyConnect Secure Mobility Client Administrator Guide

Release 4.10

"AnyConnect Posture" section: "The AnyConnect Posture module works with the Cisco Identity Services Engine (ISE) to determine the compliance of an endpoint. Based on the posture status

ISE can control the endpoint's access to the network... Posture checks include checking for applications (antivirus

antispyware

and so on)

files

registry entries

and operating systems." (Reference: Chapter: About the AnyConnect Posture Module)

3. Cisco Press

"350-701 SCOR Official Cert Guide"

Chapter 15: Endpoint Protection and Detection: "The Cisco AnyConnect client has a posture module that can be used to check the endpoint for compliance with corporate policy. The posture module can check for things like the OS version

patch level

antivirus software and definitions

and more. The posture information is sent to the Cisco Identity Services Engine (ISE)

which can then make an authorization decision based on the posture information."