SISE Profiler — 20 Questions

Question 1

A network administrator needs to profile IP phones using CDP. Which probe must be enabled on the ISE Policy Service Node (PSN) to ensure CDP information is processed?

Accepted Answer

SNMP Query probe. The SNMP Query probe is required to collect CDP neighbor information from switches.

Answer

DHCP probe

Answer

RADIUS probe

Answer

HTTP probe

Question 2

Where in the Cisco ISE GUI do you configure the Feed Service to download the latest profiling updates?

Accepted Answer

Policy > Profiling > Feed Service. The Profiler Feed Service settings are located under Policy > Profiling > Feed Service.

Answer

Operations > Feed Service

Answer

Administration > System > Feed Service

Answer

Policy > Policy Elements > Results

Question 3

When using the DHCP probe, which specific DHCP Option is most commonly used to identify a Cisco IP Phone?

Accepted Answer

Option 150. Option 150 is the standard DHCP option used by Cisco IP Phones to locate the TFTP server, making it a reliable identifier.

Answer

Option 60

Answer

Option 12

Answer

Option 55

Question 4

You have multiple PSNs. How do you ensure that profiling data is synchronized across the deployment?

Accepted Answer

The Monitoring node (MnT) collects data from all PSNs.. Profiling data is stored in the MnT node, which acts as the centralized repository for all PSNs in the deployment.

Answer

Configure a manual sync between PSNs.

Answer

Enable Database replication on each PSN.

Answer

Use the Feed Service on every PSN.

Question 5

You are configuring Cisco ISE Profiling for a network segment with IP phones that do not support LLDP-MED. Which probe combination is most effective for identifying these endpoints with high confidence?

Accepted Answer

DHCP and HTTP. DHCP and HTTP probes are critical when LLDP or CDP information is missing, as they provide vendor-specific options and User-Agent strings, respectively.

Answer

NMAP and NetFlow

Answer

SNMP Query and RADIUS Accounting

Answer

CDP and DNS

Question 6

You want to improve profiling accuracy for endpoints that do not send DHCP options. You decide to use SNMP Trap profiling. What is a critical prerequisite for this to function?

Accepted Answer

The network device must be configured to send SNMP traps to the ISE PSN IP address.. SNMP Traps require the network device to be configured to send traps to the ISE node as a destination.

Answer

The endpoint must support SNMP agents.

Answer

The ISE node must have the SNMP Query probe enabled.

Answer

RADIUS Accounting must be disabled.

Question 7

Which probe is most effective for identifying the specific operating system and browser type of an endpoint connecting via a web portal?

Accepted Answer

HTTP probe. The HTTP probe inspects the User-Agent string in HTTP headers, which identifies the browser and OS.

Answer

DHCP probe

Answer

MAC OUI probe

Answer

DNS probe

Question 8

You are configuring a custom profiling policy and notice that the 'Certainty Factor' is too low for the device to be assigned to the correct group. What is the purpose of the Certainty Factor in ISE?

Accepted Answer

To indicate the confidence level that the device is correctly profiled.. The Certainty Factor is a numerical value that increases as more matching conditions are met, ensuring a higher confidence in the device identity.

Answer

To determine the priority of the profiling policy.

Answer

To force the device to re-authenticate.

Answer

To limit the number of devices in an endpoint group.

Question 9

You are troubleshooting an issue where IP phones are not being profiled. The SNMP read community string on the switch does not match the one configured in ISE. What is the expected behavior?

Accepted Answer

The SNMP Query probe will fail to collect CDP/LLDP data from the switch.. If the SNMP community string is incorrect, ISE cannot query the switch, and the SNMP Query probe will fail to gather data.

Answer

The endpoint will be profiled based on the MAC OUI only.

Answer

The SNMP trap probe will still work.

Answer

ISE will automatically update the community string on the switch.

Question 10

You have created a custom profiler condition that is not matching endpoints correctly. Where should you check the live authentication and profiling logs to verify if the attribute is being received by ISE?

Accepted Answer

Operations > RADIUS Livelogs. The RADIUS Live Logs or Profiling Live Logs under Operations are the standard locations to verify attribute collection.

Answer

Administration > System > Logging

Answer

Policy > Profiling > Profiling Policies

Answer

Context Visibility > Endpoints

Question 11

You are configuring a DHCP probe on a Cisco ISE node to identify endpoints. Which specific configuration step is required to ensure the ISE node receives DHCP traffic when the client and server are on a different subnet?

Accepted Answer

Configure an IP helper-address on the Layer 3 device for the client VLAN pointing to the ISE node.. IP Helper-address must be configured on the default gateway to forward DHCP broadcasts to the ISE node acting as a probe.

Answer

Configure a DHCP relay agent on the ISE node itself.

Answer

Enable DHCP Server mode on the Cisco ISE Profiling service.

Answer

Enable DHCP Snooping on the ISE node interface.

Question 12

Which of the following is NOT a valid probe type in Cisco ISE?

Accepted Answer

ICMP. 'ICMP' is not a dedicated probe type for profiling in the Cisco ISE interface; it is used for connectivity testing.

Answer

SNMP Query

Answer

DHCP

Answer

RADIUS

Question 13

Which attribute is used by the MAC OUI probe to determine the device manufacturer?

Accepted Answer

MAC Address prefix (first 3 bytes). The MAC OUI probe parses the first 3 bytes of the MAC address to identify the vendor.

Answer

User-Agent string

Answer

IP Address

Answer

DHCP Client ID

Question 14

You are observing that an endpoint is being profiled as 'Unknown' even though it is clearly a Windows workstation. What is the most likely reason?

Accepted Answer

The necessary probes are not receiving enough attributes to match a policy.. If ISE has not received enough attributes to meet the threshold of a profiling policy, it remains 'Unknown'.

Answer

The device is using a static IP.

Answer

The endpoint is not authenticated.

Answer

The endpoint has a firewall enabled.

Question 15

When setting up a custom endpoint identity group for printers, what is the best practice for assigning devices to that group?

Accepted Answer

Use a Profiling Policy to automatically assign the device to the 'Printers' Identity Group.. Using a profiling policy to automatically assign endpoints to a group based on matching conditions is the most scalable approach.

Answer

Manually add every printer MAC address to the group.

Answer

Import a CSV file periodically.

Answer

Use an Authorization Policy to bypass profiling.

Question 16

Which component of the Cisco ISE Profiling architecture is responsible for comparing collected attributes against defined profiling policies?

Accepted Answer

Policy Service Node (PSN) Profiler Service. The Profiler service on the PSN acts as the policy engine that matches attributes to policies.

Answer

Monitoring Node (MnT)

Answer

Feed Service

Answer

Administration Node (PAN)

Question 17

What is the impact of changing the 'Minimum Certainty Factor' in a Profiling Policy?

Accepted Answer

It requires more attributes to match before the policy is triggered.. A higher threshold requires more matching attributes, making the profiling more restrictive and potentially less likely to match.

Answer

It triggers an automatic purge of endpoint cache.

Answer

It disables the probe for that policy.

Answer

It changes the priority of the policy.

Question 18

Where do you view the 'Context Visibility' of endpoints in Cisco ISE?

Accepted Answer

Context Visibility > Endpoints. The Context Visibility dashboard is located under the 'Context Visibility' menu in the ISE GUI.

Answer

Administration > Network Resources

Answer

Policy > Endpoints

Answer

Operations > Context Visibility

Question 19

Which of the following describes the function of the 'Profiling Priority' setting?

Accepted Answer

It determines which policy is applied when multiple policies match.. When multiple profiling policies match, the one with the highest priority (lowest number) is applied.

Answer

It defines the order in which probes are executed.

Answer

It sets the order of endpoint group assignment.

Answer

It controls which PSN processes the policy.

Question 20

You are configuring a device sensor on a Cisco switch to help with ISE profiling. What is the primary benefit of using Device Sensor?

Accepted Answer

It enables the switch to send collected device attributes to ISE via RADIUS accounting.. Device Sensor allows the switch to collect device information and send it to ISE using RADIUS Accounting, reducing the need for SNMP queries.

Answer

It replaces the need for DHCP snooping.

Answer

It allows the switch to act as a RADIUS server.

Answer

It increases the throughput of the switch.