SISE Profiler Practice Test 3 — 15 Questions

Question 1

You are configuring a device sensor on a Cisco switch to help with ISE profiling. What is the primary benefit of using Device Sensor?

Accepted Answer

It enables the switch to send collected device attributes to ISE via RADIUS accounting.. The primary benefit of Device Sensor on a Cisco switch is that it collects device attributes (e.g., CDP, LLDP, DHCP, HTTP) and sends them to Cisco ISE via RADIUS accounting packets. This enriches ISE's profiling database, allowing ISE to more accurately identify and classify endpoints. Device Sensor offloads the collection from ISE to the switch, improving scalability and reducing network traffic.

Answer

It replaces the need for DHCP snooping.

Answer

It allows the switch to act as a RADIUS server.

Answer

It increases the throughput of the switch.

Question 2

You need to profile IoT devices that only support mDNS. Which probe should you enable?

Accepted Answer

mDNS probe. For IoT devices that only support mDNS (Multicast DNS, used by Bonjour, Chromecast, AirPrint, and similar services), the mDNS probe is the correct choice because it captures mDNS traffic and extracts service and device attributes for profiling. Enabling the mDNS probe allows ISE to identify devices that don't participate in DHCP fingerprinting or RADIUS-based profiling.

Answer

DHCP probe

Answer

SNMP Query probe

Answer

HTTP probe

Question 3

When a new device connects, you notice it stays in the 'Unknown' profile state. You have confirmed the probes are active. What is the most likely step to fix this?

Accepted Answer

Create or update a Profiling Policy to match the collected attributes.. If a device remains in the 'Unknown' profile state despite active probes, it means ISE is collecting attributes but no profiling policy matches those attributes to assign a known profile. Creating or updating a profiling policy to match the collected attributes will allow ISE to classify the device correctly. The other options do not address the root cause: SNMP timeout, PSN service restart, or deleting the endpoint are not relevant to policy matching.

Answer

Increase the SNMP timeout.

Answer

Disable and re-enable the PSN service.

Answer

Delete the endpoint from the database.

Question 4

What is the purpose of the 'Endpoint Identity Group' in the context of profiling?

Accepted Answer

To classify devices for use in authorization policy rules.. The Endpoint Identity Group in Cisco ISE is used to classify devices based on their profiling attributes. These groups are then referenced in authorization policy rules to apply appropriate access controls. For example, a group 'Printers' can be used in an authorization rule to grant printers access to specific network resources. Thus, its primary purpose is to classify devices for use in authorization policy rules.

Answer

To manage authentication credentials.

Answer

To store device hardware serial numbers.

Answer

To define which PSN handles the device.

Question 5

When configuring an SNMP Query probe, why is it recommended to use SNMPv3 instead of SNMPv1/v2c?

Accepted Answer

SNMPv3 provides authentication and encryption for the query.. SNMPv3 is recommended over SNMPv1/v2c for SNMP Query probes because it provides authentication and encryption, ensuring that the queries and responses are secure. SNMPv1/v2c use plaintext community strings, which are vulnerable to eavesdropping and unauthorized access. SNMPv3 also supports stronger security models like USM (User-based Security Model).

Answer

SNMPv3 is the only version supported by ISE.

Answer

SNMPv3 is faster.

Answer

SNMPv3 eliminates the need for a community string.

Question 6

You are using the Feed Service to update your profiling policies. How can you ensure that custom profiling policies you have created are not overwritten during the update?

Accepted Answer

Custom policies are not affected by Feed Service updates.. Cisco ISE's Feed Service updates only the system-provided profiling policies that ship with ISE; custom profiling policies created by administrators are stored separately and are not overwritten or removed during a feed update. This design lets organizations receive updated fingerprints for new device types without losing their own customizations.

Answer

Place custom policies in the system policy folder.

Answer

Export custom policies before every update.

Answer

Disable automatic updates.

Question 7

Which THREE of the following are valid methods for collecting endpoint attributes for profiling in Cisco ISE?

Accepted Answer

HTTP User-Agent. HTTP User-Agent (C) is valid because ISE's HTTP profiling probe captures the User-Agent string from web requests to identify the endpoint's OS and browser. DHCP Snooping/Helper (D) is valid because ISE's DHCP probe collects attributes such as DHCP fingerprint, hostname, and vendor class from DHCP traffic relayed by the switch or helper address. SNMP Query (E) is valid because ISE can poll network devices via SNMP to retrieve endpoint attributes like MAC address, ARP tables, and CDP/LLDP neighbor data. FTP inspection (A) is not a supported ISE profiling probe, and SSH terminal login (B) is not a profiling collection method in ISE.

Answer

FTP inspection

Answer

SSH terminal login

Question 8

What is the function of the 'RADIUS Accounting' probe in the profiling process?

Accepted Answer

To collect device attributes contained in RADIUS accounting packets.. It collects session information from the RADIUS traffic, providing start/stop and attribute data useful for device identification.

Answer

To encrypt the session.

Answer

To act as a RADIUS server.

Answer

To authenticate the device.

Question 9

A user reports that a device was incorrectly identified as a 'Cisco IP Phone' when it is actually a 'Cisco Access Point'. Which troubleshooting step should you take first?

Accepted Answer

Check the endpoint attributes in Context Visibility to see why it matched that policy.. The first troubleshooting step is to check the endpoint's attributes in Context Visibility, which shows the collected profiling attributes, the matched profiling policies, and the confidence scores that led to the 'Cisco IP Phone' classification. This reveals whether the misclassification is due to incorrect attributes (e.g., a stale MAC OUI match) or an overly broad profiling policy, allowing targeted correction.

Answer

Re-register the device.

Answer

Delete all profiling policies.

Answer

Restart the ISE node.

Question 10

Which THREE of the following are true regarding the Cisco ISE Profiler Feed Service?

Accepted Answer

It can be configured to update automatically on a schedule.. Option B is correct because the Profiler Feed Service can be scheduled to poll Cisco's update servers automatically at a configured interval (for example, daily or weekly) so that endpoint profile policies stay current without manual intervention. Option C is correct because the service's core function is to download updated profiling policies and Cisco-provided endpoint profile definitions from Cisco's feed servers to the ISE deployment. Option E is correct because the Policy Administration Node (PAN) is the node that contacts the external Cisco feed servers, so it requires outbound internet access (HTTPS/443) to retrieve those updates. Option A is not correct because the feed service only supplies profile/policy updates; actual assignment of endpoints to identity groups is performed by ISE's profiling engine and authorization policies, not by the feed itself. Option D is not correct because the Profiler Feed Service is optional — ISE can profile endpoints using built-in and custom policies without ever enabling the feed service.

Answer

It automatically assigns devices to groups.

Answer

It is mandatory for all deployments.

Question 11

Which THREE of the following items must be configured to ensure a successful SNMP Trap profiling implementation?

Accepted Answer

Add the network switch to the ISE Network Devices list.. Option A is correct because the switch sending SNMP traps must exist as a Network Device in ISE, which provides the shared secret and device definition ISE uses to authenticate and process incoming SNMP traffic from that switch. Option B is correct because the SNMP Trap probe must be enabled on the ISE PSN that will receive the traps; without this probe running, ISE will not listen for or process SNMP trap notifications. Option D is correct because the switch itself must be configured with the ISE PSN as a trap destination (snmp-server host <PSN-IP> ...), otherwise no traps are ever sent to ISE and profiling data is never collected. Option C is not required because the HTTP probe is used for HTTP-based profiling (User-Agent, URL data) and is unrelated to receiving SNMP traps. Option E is not required because DHCP Snooping is a Layer 2 switch security feature for DHCP traffic, not a prerequisite for SNMP Trap profiling.

Answer

Enable HTTP probe.

Answer

Configure DHCP Snooping.

Question 12

Which THREE of the following are considered 'probes' in the Cisco ISE Profiling architecture?

Accepted Answer

DHCP. In Cisco ISE profiling, a probe is any mechanism that collects endpoint attribute data to feed the profiling engine, and DHCP, SNMP Query, and HTTP are all valid probe types. DHCP (B) is correct because ISE uses DHCP probes (via DHCP snooping/relay or the DHCP probe on the PSN) to capture DHCP option fields such as Option 55 parameter request list, hostname, and vendor class for endpoint classification. SNMP Query (D) is correct because ISE can actively poll network devices via SNMP to retrieve information like ARP tables, MAC address tables, CDP/LLDP neighbors, and session data, which are used as profiling attributes. HTTP (E) is correct because the HTTP probe captures User-Agent strings and other HTTP header data from web traffic to help identify endpoint OS and device type. ICMP Echo (A) is not a profiling probe in ISE; it is only used for reachability testing (e.g., in posture or endpoint tests), not for gathering profiling attributes. ARP Inspection (C) is a switch security feature (Dynamic ARP Inspection) rather than an ISE profiling probe; ISE may consume ARP data via SNMP or other probes, but ARP Inspection itself is not classified as a probe.

Answer

ICMP Echo

Answer

ARP Inspection

Question 13

Which TWO of the following are necessary to correctly configure a custom profiling condition based on DHCP attributes?

Accepted Answer

Define a matching operator (e.g., equals, contains).. Option C is correct because a profiling condition must specify a matching operator (such as equals, contains, starts with, or matches regex) that determines how the collected DHCP attribute value is compared against the configured value. Option E is correct because the condition must reference a valid DHCP attribute from the available attribute list (for example, DHCP Option 12 hostname, Option 60 vendor class identifier, or Option 55 parameter request list) so the profiler knows which DHCP field to evaluate. Together, selecting the DHCP attribute and defining its matching operator are the two essential components of a custom DHCP-based profiling condition. Option A is not required because HTTP profiling is a separate profiling method used for HTTP User-Agent attributes, not DHCP. Option B is not required because DHCP profiling relies on the DHCP request/response exchange and does not depend on the endpoint having a static IP. Option D is not required because clearing the switch MAC address table is unrelated to defining a profiling condition and would not affect DHCP attribute matching.

Answer

Enable HTTP profiling.

Answer

Configure a static IP on the endpoint.

Answer

Clear the MAC address table on the switch.

Question 14

Which THREE of the following are common reasons why an endpoint would be listed as 'Unknown' in Cisco ISE?

Accepted Answer

The endpoint has not generated enough traffic to trigger a probe.. Option C is correct because Cisco ISE profiling relies on collecting attributes from network traffic and other sources; if an endpoint has not generated enough traffic, insufficient attributes are gathered and the endpoint remains in the Unknown state. Option D is correct because profiling probes (such as SNMP, DHCP, RADIUS, NetFlow, and HTTP) must be enabled on the Policy Services Node (PSN); if the required probes are disabled, ISE cannot collect the endpoint attributes needed to identify it. Option E is correct because even when attributes are collected, ISE must match them against configured profiling policies; if no profiling policy matches the collected attributes, the endpoint is classified as Unknown. Option A is not necessarily correct because ISE can profile endpoints on non-Cisco switches using probes like DHCP, RADIUS, and NetFlow, so the switch vendor alone does not cause Unknown status. Option B is not necessarily correct because ISE can profile endpoints that do not use 802.1X through other probes such as DHCP, SNMP, and NetFlow, so lack of 802.1X alone does not make an endpoint Unknown.

Answer

The device is connected to a non-Cisco switch.

Answer

The endpoint is not using 802.1X.

Question 15

Which probe is required to collect the 'User-Agent' string from a web browser to assist in profiling a device as a workstation?

Accepted Answer

HTTP. The HTTP probe in ISE collects attributes from HTTP traffic, including the User-Agent string sent by web browsers. This string (e.g., 'Mozilla/5.0 ... Windows NT 10.0 ...') is a key fingerprint used to profile a device as a workstation. Without the HTTP probe, ISE would not see the User-Agent and would have to rely on other probes like DHCP or RADIUS, which do not carry that information.

Answer

RADIUS

Answer

DHCP

Answer

DNS