Selected Answer: AE https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Administrator_Guide_4-0/deploy-anyconnect.html#:~:text=Endpoint%20for%20AnyConnect-,Predeploying%20AnyConnect,-Web%20Deploying%20AnyConnect The Cisco AnyConnect Secure Mobility Client can be deployed to remote users by these methods: Predeploy—New installations and upgrades are handled either by the end user, or by using an enterprise software management system (SMS). Web Deploy—The AnyConnect package is placed on the headend, which is either an ASA or FTD firewall, or an ISE server. When the user connects to a firewall or to ISE, AnyConnect gets deployed to the client.