Cisco Anyconnect certificate selection process

Anyconnect stores the last used certificate's thumb-print in
C:\Users\termo\AppData\Local\Cisco\Cisco AnyConnect Secure Mobility Client\preferences.xml

Caching can be disabled in C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\AnyConnectLocalPolicy.xml under 
<RestrictPreferenceCaching>Thumbprints</RestrictPreferenceCaching>

And if thumbprint exists, then Anyconnect will try and use that certificate first.