SISE Profiler Practice Test 2 — 15 Questions

Question 1

Which THREE of the following are valid ways to trigger a profiling scan or update for an endpoint in Cisco ISE?

Accepted Answer

Manually trigger 'Re-profile' in Context Visibility.. Option A is correct because in Cisco ISE's Context Visibility you can manually select an endpoint and use the 'Re-profile' action to force an immediate profiling scan of that endpoint. Option B is correct because when ISE receives a new probe update (for example, from RADIUS, SNMP, DHCP, or an HTTP probe) for an endpoint, that new attribute data triggers the profiling engine to re-evaluate and update the endpoint's profile. Option D is correct because a Change of Authorization (CoA) sent from a policy rule causes the endpoint to re-authenticate, and the resulting session/probe data triggers a profiling scan or update. Option C is not a valid trigger by itself, since merely changing an IP address does not initiate profiling unless it is learned through a probe or session event. Option E is not valid because modifying an endpoint's MAC address is not a supported ISE profiling trigger and would not normally occur as a profiling event.

Answer

Change the device's IP address.

Answer

Modify the endpoint's MAC address.

Question 2

A Cisco ISE administrator needs to profile endpoints that are connected to a Cisco Catalyst 9000 switch. The switch is configured with the 'device-sensor filter-list dhcp' command and the 'device-sensor filter-spec dhcp' command. However, ISE is not receiving any DHCP profiling data from the switch. Which action must be taken on the switch to allow the device sensor to send DHCP attributes to ISE?

Accepted Answer

Enable the device sensor on the switch port by using the 'device-sensor' command in interface configuration mode.. The device sensor feature on Cisco switches requires both global configuration to define the filter lists and interface-level configuration to activate the sensor on specific ports. The global commands 'device-sensor filter-list dhcp' and 'device-sensor filter-spec dhcp' define what data to collect, but the sensor must be enabled on each interface where endpoints connect. Without the interface-level 'device-sensor' command, no DHCP attributes are collected or sent to ISE, so profiling fails. Enabling the sensor on the interface allows the switch to include the configured DHCP options in RADIUS accounting packets, which ISE uses for profiling.

Answer

Configure the 'ip dhcp snooping' feature on the switch to intercept DHCP packets.

Answer

Configure the 'device-sensor notify' command to specify ISE as the notification target.

Answer

Add the 'device-sensor filter-list dhcp' command to the interface configuration.

Question 3

A network administrator is configuring profiling policies in Cisco ISE to identify Cisco IP Phones. The administrator wants to ensure that the phones are correctly profiled and placed in the appropriate endpoint identity group. Which probe provides the most reliable and detailed information for profiling Cisco IP Phones, especially when they are connected to the network?

Accepted Answer

CDP probe. The CDP probe is the most reliable for profiling Cisco IP Phones because these phones natively send CDP packets that contain detailed attributes such as device type, model, and software version. This information allows ISE to accurately identify the phone and assign it to the correct endpoint identity group. Other probes like DHCP and RADIUS provide limited attributes and are less specific for phone profiling.

Answer

RADIUS probe

Answer

DHCP probe

Answer

SNMP probe

Question 4

A network administrator is deploying Cisco ISE profiling in a network where IP phones are connected to Cisco switches. The administrator wants to ensure that the phones are profiled accurately using CDP. Which probe must be enabled on the ISE Policy Service node to collect CDP attributes from the switches?

Accepted Answer

CDP probe. The CDP probe is designed to capture Cisco Discovery Protocol packets from network devices. These packets contain information such as the device type, platform, and software version, which ISE uses to profile endpoints. For IP phones that advertise via CDP, enabling the CDP probe on the Policy Service node is essential to collect the necessary attributes for accurate profiling.

Answer

SNMP probe

Answer

LLDP probe

Answer

RADIUS probe

Question 5

You want to improve profiling accuracy for endpoints that do not send DHCP options. You decide to use SNMP Trap profiling. What is a critical prerequisite for this to function?

Accepted Answer

The network device must be configured to send SNMP traps to the ISE PSN IP address.. SNMP Trap profiling requires the network device (switch, WLC, router) to be configured to send SNMP traps to the ISE PSN's IP address, because ISE relies on receiving those traps to extract endpoint attributes like MAC addresses, link up/down events, and CDP/LLDP neighbor data. Without the device actively sending traps to ISE, the SNMP Trap probe receives no data and profiling cannot occur.

Answer

The endpoint must support SNMP agents.

Answer

The ISE node must have the SNMP Query probe enabled.

Answer

RADIUS Accounting must be disabled.

Question 6

Which probe is most effective for identifying the specific operating system and browser type of an endpoint connecting via a web portal?

Accepted Answer

HTTP probe. The HTTP probe is the most effective for identifying OS and browser type because it collects User-Agent strings and other HTTP headers sent by the endpoint's browser during web portal authentication. These headers contain detailed information about the operating system, browser name, and version, which ISE uses to match profiling policies. No other probe provides this level of browser-specific detail.

Answer

DHCP probe

Answer

MAC OUI probe

Answer

DNS probe

Question 7

You are configuring a custom profiling policy and notice that the 'Certainty Factor' is too low for the device to be assigned to the correct group. What is the purpose of the Certainty Factor in ISE?

Accepted Answer

To indicate the confidence level that the device is correctly profiled.. The Certainty Factor in ISE is a numerical value (0-100) that represents how confident the profiling engine is that a device belongs to a particular profile. It is calculated based on the number and weight of matched conditions in the profiling policy. A higher certainty factor increases the likelihood that the device will be assigned to the correct group, while a low certainty factor indicates that the collected attributes do not strongly match any profile.

Answer

To determine the priority of the profiling policy.

Answer

To force the device to re-authenticate.

Answer

To limit the number of devices in an endpoint group.

Question 8

You are troubleshooting an issue where IP phones are not being profiled. The SNMP read community string on the switch does not match the one configured in ISE. What is the expected behavior?

Accepted Answer

The SNMP Query probe will fail to collect CDP/LLDP data from the switch.. The SNMP Query probe in ISE polls the switch via SNMP to retrieve CDP/LLDP neighbor data for profiling. If the SNMP read community string configured in ISE does not match the switch, the SNMP query fails and ISE cannot collect that CDP/LLDP data, so profiling is degraded or fails. This is the expected behavior described in option C.

Answer

The endpoint will be profiled based on the MAC OUI only.

Answer

The SNMP trap probe will still work.

Answer

ISE will automatically update the community string on the switch.

Question 9

You have created a custom profiler condition that is not matching endpoints correctly. Where should you check the live authentication and profiling logs to verify if the attribute is being received by ISE?

Accepted Answer

Operations > RADIUS Livelogs. RADIUS Livelogs under Operations is the real-time troubleshooting view in ISE that shows authentication and authorization requests as they arrive, including the RADIUS attributes (Cisco AV pairs, Calling-Station-ID, etc.) that the NAD sends. When a custom profiler condition fails to match, you need to confirm whether the attribute the condition depends on is actually being received from the network device. RADIUS Livelogs displays the raw attribute payload of each Access-Request, so you can verify attribute presence, spelling, and value before blaming the profiling policy.

Answer

Administration > System > Logging

Answer

Policy > Profiling > Profiling Policies

Answer

Context Visibility > Endpoints

Question 10

You are configuring a DHCP probe on a Cisco ISE node to identify endpoints. Which specific configuration step is required to ensure the ISE node receives DHCP traffic when the client and server are on a different subnet?

Accepted Answer

Configure an IP helper-address on the Layer 3 device for the client VLAN pointing to the ISE node.. To ensure the ISE node receives DHCP traffic when the client and DHCP server are on different subnets, you must configure an IP helper-address on the Layer 3 device (e.g., router or switch) for the client VLAN, pointing to the ISE node. This relays DHCP packets to ISE, allowing the DHCP probe to collect profiling data. Thus, option C is correct.

Answer

Configure a DHCP relay agent on the ISE node itself.

Answer

Enable DHCP Server mode on the Cisco ISE Profiling service.

Answer

Enable DHCP Snooping on the ISE node interface.

Question 11

Which of the following is NOT a valid probe type in Cisco ISE?

Accepted Answer

ICMP. Cisco ISE supports several active probe types for endpoint profiling: DHCP, RADIUS, SNMP Query, SNMP Trap, NetFlow, DNS, HTTP, and NMAP, among others. ICMP is not one of the configurable probe types in ISE's profiling configuration — while ISE may send pings internally for reachability, ICMP is not exposed as a profiling probe. Therefore ICMP is the option that is NOT a valid probe type.

Answer

SNMP Query

Answer

DHCP

Answer

RADIUS

Question 12

Which attribute is used by the MAC OUI probe to determine the device manufacturer?

Accepted Answer

MAC Address prefix (first 3 bytes). The MAC OUI (Organizationally Unique Identifier) probe inspects the first 3 bytes (24 bits) of a device's MAC address, which is the OUI assigned by the IEEE to a specific manufacturer. ISE maintains an internal OUI-to-vendor mapping database, so when an endpoint's MAC address is seen, the probe matches the prefix to identify the manufacturer (e.g., Apple, Samsung, Cisco). This is why the first 3 bytes are the correct answer.

Answer

User-Agent string

Answer

IP Address

Answer

DHCP Client ID

Question 13

You are observing that an endpoint is being profiled as 'Unknown' even though it is clearly a Windows workstation. What is the most likely reason?

Accepted Answer

The necessary probes are not receiving enough attributes to match a policy.. Profiling in ISE relies on collecting attributes from various probes (DHCP, HTTP, RADIUS, SNMP, etc.) and matching them against profiling policies. If the endpoint shows as 'Unknown', the most likely cause is that the probes are not receiving enough attributes — or the attributes received do not match any existing policy condition. Without sufficient attribute data, ISE cannot classify the device even if it is obviously a Windows workstation to a human.

Answer

The device is using a static IP.

Answer

The endpoint is not authenticated.

Answer

The endpoint has a firewall enabled.

Question 14

When setting up a custom endpoint identity group for printers, what is the best practice for assigning devices to that group?

Accepted Answer

Use a Profiling Policy to automatically assign the device to the 'Printers' Identity Group.. The best practice for assigning devices to a custom endpoint identity group is to use a Profiling Policy. Profiling policies automatically classify endpoints based on collected attributes (e.g., DHCP, HTTP, SNMP) and assign them to the appropriate identity group. This ensures dynamic and scalable management, reducing manual effort and errors.

Answer

Manually add every printer MAC address to the group.

Answer

Import a CSV file periodically.

Answer

Use an Authorization Policy to bypass profiling.

Question 15

Which component of the Cisco ISE Profiling architecture is responsible for comparing collected attributes against defined profiling policies?

Accepted Answer

Policy Service Node (PSN) Profiler Service. The Policy Service Node (PSN) Profiler Service is responsible for collecting endpoint attributes and comparing them against profiling policies to determine the device profile. The PSN hosts the profiler service, which includes the profiling engine that evaluates conditions and assigns certainty factors. The PAN (Administration Node) manages the configuration and policies, but the actual profiling decision is made by the PSN.

Answer

Monitoring Node (MnT)

Answer

Feed Service

Answer

Administration Node (PAN)