SISE Profiler — Timed 10 Questions

Question 1

A network administrator needs to profile IP phones using CDP. Which probe must be enabled on the ISE Policy Service Node (PSN) to ensure CDP information is processed?

Accepted Answer

SNMP Query probe. The SNMP Query probe is required to collect CDP neighbor information from switches.

Answer

DHCP probe

Answer

RADIUS probe

Answer

HTTP probe

Question 2

Where in the Cisco ISE GUI do you configure the Feed Service to download the latest profiling updates?

Accepted Answer

Policy > Profiling > Feed Service. The Profiler Feed Service settings are located under Policy > Profiling > Feed Service.

Answer

Operations > Feed Service

Answer

Administration > System > Feed Service

Answer

Policy > Policy Elements > Results

Question 3

When using the DHCP probe, which specific DHCP Option is most commonly used to identify a Cisco IP Phone?

Accepted Answer

Option 150. Option 150 is the standard DHCP option used by Cisco IP Phones to locate the TFTP server, making it a reliable identifier.

Answer

Option 60

Answer

Option 12

Answer

Option 55

Question 4

You have multiple PSNs. How do you ensure that profiling data is synchronized across the deployment?

Accepted Answer

The Monitoring node (MnT) collects data from all PSNs.. Profiling data is stored in the MnT node, which acts as the centralized repository for all PSNs in the deployment.

Answer

Configure a manual sync between PSNs.

Answer

Enable Database replication on each PSN.

Answer

Use the Feed Service on every PSN.

Question 5

What is the impact of changing the 'Minimum Certainty Factor' in a Profiling Policy?

Accepted Answer

It requires more attributes to match before the policy is triggered.. The Minimum Certainty Factor in a Cisco Identity Services Engine (ISE) Profiling Policy defines the confidence threshold that must be met for a profile to be assigned to an endpoint. When you increase this value, the profiling engine requires a higher degree of certainty—meaning more attributes must match the profile's conditions—before the policy is triggered. Thus, option A correctly describes the impact: it requires more attributes to match before the policy is triggered.

Answer

It triggers an automatic purge of endpoint cache.

Answer

It disables the probe for that policy.

Answer

It changes the priority of the policy.

Question 6

Where do you view the 'Context Visibility' of endpoints in Cisco ISE?

Accepted Answer

Context Visibility > Endpoints. In Cisco ISE, endpoint context data (identity, posture, profiling, and authentication history) is viewed under the Context Visibility menu, specifically Context Visibility > Endpoints. This is where administrators inspect endpoint attributes, profiling results, and compliance state.

Answer

Administration > Network Resources

Answer

Policy > Endpoints

Answer

Operations > Context Visibility

Question 7

Which of the following describes the function of the 'Profiling Priority' setting?

Accepted Answer

It determines which policy is applied when multiple policies match.. Profiling Priority in ISE determines which profiling policy is applied when an endpoint matches multiple profiling policies simultaneously. It is a numeric value (1–1000, lower = higher priority) assigned to each profiling policy, and the policy with the best (lowest) priority value wins. This resolves conflicts when an endpoint exhibits attributes matching several policies at once.

Answer

It defines the order in which probes are executed.

Answer

It sets the order of endpoint group assignment.

Answer

It controls which PSN processes the policy.

Question 8

Which TWO of the following are required to successfully profile a device using SNMP Query?

Accepted Answer

The device must have the SNMP Query probe enabled.. Option A is correct because the SNMP Query probe must be enabled on the device (or its profile policy) so that Cisco ISE actually sends SNMP GET requests to gather attributes like sysObjectID and sysDescr for profiling. Option D is correct because the network device (the switch, WLC, or router that ISE queries) must be defined in the ISE Network Devices list with valid SNMP read-only community strings or SNMPv3 credentials, otherwise ISE cannot authenticate and reach it for the query. Option B is wrong because DHCP Option 150 is a Cisco-specific TFTP server option used for IP phone provisioning, not an SNMP profiling requirement. Option C is wrong because SNMP Query can profile devices with DHCP-assigned addresses as long as ISE can reach the device's current IP. Option E is wrong because the SNMP agent runs on the endpoint being profiled only for SNMP-based endpoint profiling, whereas SNMP Query in ISE profiles endpoints by querying the network access device, not the endpoint itself.

Answer

The device must support DHCP Option 150.

Answer

The device must have a static IP address.

Answer

The device must be running an SNMP Agent.

Question 9

Which TWO of the following are potential sources of information for the DHCP probe?

Accepted Answer

DHCP Option 60 (Vendor Class Identifier). DHCP Option 60 (Vendor Class Identifier) is a correct source because the DHCP probe inspects the vendor class identifier sent by the client to identify the requesting device's vendor and type, which helps classify endpoints. DHCP Option 55 (Parameter Request List) is also correct because it lists the parameters the client is requesting from the DHCP server, and the probe uses this fingerprint to infer the client's operating system or device profile. These two options are DHCP options carried in the client's request and are directly parsed by the probe for device identification. In contrast, the Layer 2 source MAC address (A) and the IP header source address (B) are not DHCP options and are not the probe's designated information sources, and DHCP Option 12 (C) is the host name, which is not marked as a correct source for this probe.

Answer

Layer 2 source MAC address.

Answer

IP Header Source Address.

Answer

DHCP Option 12 (Host Name)

Question 10

Which TWO of the following are true regarding the use of 'Endpoint Identity Groups' in Cisco ISE?

Accepted Answer

They are used to categorize endpoints for policy enforcement.. Option A is correct because Endpoint Identity Groups in Cisco ISE are logical containers that classify endpoints (by MAC address, profiling attributes, etc.) so that authorization and posture policies can be applied to categories of devices rather than to individual endpoints. Option B is correct because Endpoint Identity Groups are directly usable as conditions in Authorization Policy rules — for example, matching Endpoints:EndpointIdentityGroup equals 'Workstations' — which is one of their primary purposes in policy enforcement. Option C is incorrect because user roles are represented by User Identity Groups (or external identity store groups), not Endpoint Identity Groups, which describe devices rather than people. Option D is incorrect because ISE does not automatically purge Endpoint Identity Groups every 24 hours; endpoints and their group memberships persist until administratively removed or aged out by configured endpoint purge policies. Option E is incorrect because an endpoint can belong to only one Endpoint Identity Group at a time in ISE, even though it may match multiple profiler policies.

Answer

They are used to define the user's role.

Answer

They are automatically purged every 24 hours.

Answer

An endpoint can belong to multiple groups simultaneously.