SISE Profiler — Timed 30 Questions

Question 1

A network administrator needs to profile IP phones using CDP. Which probe must be enabled on the ISE Policy Service Node (PSN) to ensure CDP information is processed?

Accepted Answer

SNMP Query probe. The SNMP Query probe is required to collect CDP neighbor information from switches.

Answer

DHCP probe

Answer

RADIUS probe

Answer

HTTP probe

Question 2

Where in the Cisco ISE GUI do you configure the Feed Service to download the latest profiling updates?

Accepted Answer

Policy > Profiling > Feed Service. The Profiler Feed Service settings are located under Policy > Profiling > Feed Service.

Answer

Operations > Feed Service

Answer

Administration > System > Feed Service

Answer

Policy > Policy Elements > Results

Question 3

When using the DHCP probe, which specific DHCP Option is most commonly used to identify a Cisco IP Phone?

Accepted Answer

Option 150. Option 150 is the standard DHCP option used by Cisco IP Phones to locate the TFTP server, making it a reliable identifier.

Answer

Option 60

Answer

Option 12

Answer

Option 55

Question 4

You have multiple PSNs. How do you ensure that profiling data is synchronized across the deployment?

Accepted Answer

The Monitoring node (MnT) collects data from all PSNs.. Profiling data is stored in the MnT node, which acts as the centralized repository for all PSNs in the deployment.

Answer

Configure a manual sync between PSNs.

Answer

Enable Database replication on each PSN.

Answer

Use the Feed Service on every PSN.

Question 5

What is the impact of changing the 'Minimum Certainty Factor' in a Profiling Policy?

Accepted Answer

It requires more attributes to match before the policy is triggered.. The Minimum Certainty Factor in a Cisco Identity Services Engine (ISE) Profiling Policy defines the confidence threshold that must be met for a profile to be assigned to an endpoint. When you increase this value, the profiling engine requires a higher degree of certainty—meaning more attributes must match the profile's conditions—before the policy is triggered. Thus, option A correctly describes the impact: it requires more attributes to match before the policy is triggered.

Answer

It triggers an automatic purge of endpoint cache.

Answer

It disables the probe for that policy.

Answer

It changes the priority of the policy.

Question 6

Where do you view the 'Context Visibility' of endpoints in Cisco ISE?

Accepted Answer

Context Visibility > Endpoints. In Cisco ISE, endpoint context data (identity, posture, profiling, and authentication history) is viewed under the Context Visibility menu, specifically Context Visibility > Endpoints. This is where administrators inspect endpoint attributes, profiling results, and compliance state.

Answer

Administration > Network Resources

Answer

Policy > Endpoints

Answer

Operations > Context Visibility

Question 7

Which of the following describes the function of the 'Profiling Priority' setting?

Accepted Answer

It determines which policy is applied when multiple policies match.. Profiling Priority in ISE determines which profiling policy is applied when an endpoint matches multiple profiling policies simultaneously. It is a numeric value (1–1000, lower = higher priority) assigned to each profiling policy, and the policy with the best (lowest) priority value wins. This resolves conflicts when an endpoint exhibits attributes matching several policies at once.

Answer

It defines the order in which probes are executed.

Answer

It sets the order of endpoint group assignment.

Answer

It controls which PSN processes the policy.

Question 8

Which TWO of the following are required to successfully profile a device using SNMP Query?

Accepted Answer

The device must have the SNMP Query probe enabled.. Option A is correct because the SNMP Query probe must be enabled on the device (or its profile policy) so that Cisco ISE actually sends SNMP GET requests to gather attributes like sysObjectID and sysDescr for profiling. Option D is correct because the network device (the switch, WLC, or router that ISE queries) must be defined in the ISE Network Devices list with valid SNMP read-only community strings or SNMPv3 credentials, otherwise ISE cannot authenticate and reach it for the query. Option B is wrong because DHCP Option 150 is a Cisco-specific TFTP server option used for IP phone provisioning, not an SNMP profiling requirement. Option C is wrong because SNMP Query can profile devices with DHCP-assigned addresses as long as ISE can reach the device's current IP. Option E is wrong because the SNMP agent runs on the endpoint being profiled only for SNMP-based endpoint profiling, whereas SNMP Query in ISE profiles endpoints by querying the network access device, not the endpoint itself.

Answer

The device must support DHCP Option 150.

Answer

The device must have a static IP address.

Answer

The device must be running an SNMP Agent.

Question 9

Which TWO of the following are potential sources of information for the DHCP probe?

Accepted Answer

DHCP Option 60 (Vendor Class Identifier). DHCP Option 60 (Vendor Class Identifier) is a correct source because the DHCP probe inspects the vendor class identifier sent by the client to identify the requesting device's vendor and type, which helps classify endpoints. DHCP Option 55 (Parameter Request List) is also correct because it lists the parameters the client is requesting from the DHCP server, and the probe uses this fingerprint to infer the client's operating system or device profile. These two options are DHCP options carried in the client's request and are directly parsed by the probe for device identification. In contrast, the Layer 2 source MAC address (A) and the IP header source address (B) are not DHCP options and are not the probe's designated information sources, and DHCP Option 12 (C) is the host name, which is not marked as a correct source for this probe.

Answer

Layer 2 source MAC address.

Answer

IP Header Source Address.

Answer

DHCP Option 12 (Host Name)

Question 10

Which TWO of the following are true regarding the use of 'Endpoint Identity Groups' in Cisco ISE?

Accepted Answer

They are used to categorize endpoints for policy enforcement.. Option A is correct because Endpoint Identity Groups in Cisco ISE are logical containers that classify endpoints (by MAC address, profiling attributes, etc.) so that authorization and posture policies can be applied to categories of devices rather than to individual endpoints. Option B is correct because Endpoint Identity Groups are directly usable as conditions in Authorization Policy rules — for example, matching Endpoints:EndpointIdentityGroup equals 'Workstations' — which is one of their primary purposes in policy enforcement. Option C is incorrect because user roles are represented by User Identity Groups (or external identity store groups), not Endpoint Identity Groups, which describe devices rather than people. Option D is incorrect because ISE does not automatically purge Endpoint Identity Groups every 24 hours; endpoints and their group memberships persist until administratively removed or aged out by configured endpoint purge policies. Option E is incorrect because an endpoint can belong to only one Endpoint Identity Group at a time in ISE, even though it may match multiple profiler policies.

Answer

They are used to define the user's role.

Answer

They are automatically purged every 24 hours.

Answer

An endpoint can belong to multiple groups simultaneously.

Question 11

You are configuring Cisco ISE Profiling for a network segment with IP phones that do not support LLDP-MED. Which probe combination is most effective for identifying these endpoints with high confidence?

Accepted Answer

DHCP and HTTP. DHCP and HTTP probes are critical when LLDP or CDP information is missing, as they provide vendor-specific options and User-Agent strings, respectively.

Answer

NMAP and NetFlow

Answer

SNMP Query and RADIUS Accounting

Answer

CDP and DNS

Question 12

Which TWO of the following are true regarding the 'Certainty Factor' in a Profiling Policy?

Accepted Answer

It allows ISE to weigh the importance of different attribute matches.. Option B is correct because the Certainty Factor in an ISE profiling policy is a per-condition weight (a value from 1 to 10) that lets ISE express how strongly a given attribute match contributes to identifying an endpoint, so matches of differing reliability are weighted differently when the policy's total certainty is calculated. Option E is correct because the accumulated certainty from all matching conditions is compared against the policy's minimum certainty threshold, and when that threshold is met ISE assigns the endpoint to the corresponding Identity Group (the policy's resulting endpoint identity). Option A is wrong because the Certainty Factor is configured per profiling condition/policy, not as a single deployment-wide global setting. Option C is wrong because the Feed Service downloads and updates profiling attribute dictionaries and OUI/behavioral feeds, not the Certainty Factor values. Option D is wrong because profiling conditions can use many probe types (DHCP, RADIUS, HTTP, NetFlow, DNS, NMAP, etc.), not only SNMP probes.

Answer

It is a global setting for the entire ISE deployment.

Answer

It is updated automatically by the Feed Service.

Answer

It can only be used with SNMP probes.

Question 13

A administrator notices that certain medical devices are being intermittently profiled as 'Unknown' despite having a valid Profiling Policy. What is the most likely cause related to the Profiler Feed Service?

Accepted Answer

The device fingerprint signatures in the Profiler Feed Service are outdated.. The Profiler Feed Service downloads updated fingerprint and profile definitions from Cisco on a scheduled basis. If those signatures are stale, newer or vendor-specific medical device fingerprints will not be recognized, and endpoints fall back to 'Unknown' even though a valid profiling policy exists. The policy is only as good as the attribute-to-profile mappings the feed provides, so an outdated feed is the most likely root cause of intermittent misclassification.

Answer

The endpoint identity group is full.

Answer

The Monitoring node is overloaded.

Answer

The Profiler Feed Service is not enabled under Administration > System > Settings.

Question 14

You need to create a custom profiling condition to identify printers based on their MAC OUI. Which menu path should you use to define this condition?

Accepted Answer

Policy > Profiling > Profiling Conditions. In Cisco ISE, custom profiling conditions are defined under Policy > Profiling > Profiling Conditions. This is where you create logical expressions that match endpoint attributes such as MAC OUI, DHCP fingerprints, or HTTP user-agents. The MAC OUI condition specifically uses the 'MACAddress' dictionary attribute with the 'StartsWith' operator to match the first three bytes of the MAC address. Once defined, these conditions are referenced in profiling policies to assign endpoints to the correct profile.

Answer

Administration > System > Profiling

Answer

Policy > Policy Elements > Conditions

Answer

Context Visibility > Endpoints

Question 15

When configuring a Profiling Policy, what happens if an endpoint matches multiple policies?

Accepted Answer

The system matches the most specific policy (highest number of conditions).. When an endpoint matches multiple profiling policies, ISE resolves the conflict by selecting the policy with the highest number of matching conditions — the most specific match wins. This deterministic tie-breaking ensures that a narrowly defined policy (for example, one matching five attributes) overrides a broad policy that matches only one or two attributes.

Answer

The system throws a configuration error.

Answer

The endpoint is assigned to the 'Multiple' group.

Answer

The first policy created is applied.

Question 16

Which THREE of the following are valid ways to trigger a profiling scan or update for an endpoint in Cisco ISE?

Accepted Answer

Manually trigger 'Re-profile' in Context Visibility.. Option A is correct because in Cisco ISE's Context Visibility you can manually select an endpoint and use the 'Re-profile' action to force an immediate profiling scan of that endpoint. Option B is correct because when ISE receives a new probe update (for example, from RADIUS, SNMP, DHCP, or an HTTP probe) for an endpoint, that new attribute data triggers the profiling engine to re-evaluate and update the endpoint's profile. Option D is correct because a Change of Authorization (CoA) sent from a policy rule causes the endpoint to re-authenticate, and the resulting session/probe data triggers a profiling scan or update. Option C is not a valid trigger by itself, since merely changing an IP address does not initiate profiling unless it is learned through a probe or session event. Option E is not valid because modifying an endpoint's MAC address is not a supported ISE profiling trigger and would not normally occur as a profiling event.

Answer

Change the device's IP address.

Answer

Modify the endpoint's MAC address.

Question 17

A Cisco ISE administrator needs to profile endpoints that are connected to a Cisco Catalyst 9000 switch. The switch is configured with the 'device-sensor filter-list dhcp' command and the 'device-sensor filter-spec dhcp' command. However, ISE is not receiving any DHCP profiling data from the switch. Which action must be taken on the switch to allow the device sensor to send DHCP attributes to ISE?

Accepted Answer

Enable the device sensor on the switch port by using the 'device-sensor' command in interface configuration mode.. The device sensor feature on Cisco switches requires both global configuration to define the filter lists and interface-level configuration to activate the sensor on specific ports. The global commands 'device-sensor filter-list dhcp' and 'device-sensor filter-spec dhcp' define what data to collect, but the sensor must be enabled on each interface where endpoints connect. Without the interface-level 'device-sensor' command, no DHCP attributes are collected or sent to ISE, so profiling fails. Enabling the sensor on the interface allows the switch to include the configured DHCP options in RADIUS accounting packets, which ISE uses for profiling.

Answer

Configure the 'ip dhcp snooping' feature on the switch to intercept DHCP packets.

Answer

Configure the 'device-sensor notify' command to specify ISE as the notification target.

Answer

Add the 'device-sensor filter-list dhcp' command to the interface configuration.

Question 18

A network administrator is configuring profiling policies in Cisco ISE to identify Cisco IP Phones. The administrator wants to ensure that the phones are correctly profiled and placed in the appropriate endpoint identity group. Which probe provides the most reliable and detailed information for profiling Cisco IP Phones, especially when they are connected to the network?

Accepted Answer

CDP probe. The CDP probe is the most reliable for profiling Cisco IP Phones because these phones natively send CDP packets that contain detailed attributes such as device type, model, and software version. This information allows ISE to accurately identify the phone and assign it to the correct endpoint identity group. Other probes like DHCP and RADIUS provide limited attributes and are less specific for phone profiling.

Answer

RADIUS probe

Answer

DHCP probe

Answer

SNMP probe

Question 19

A network administrator is deploying Cisco ISE profiling in a network where IP phones are connected to Cisco switches. The administrator wants to ensure that the phones are profiled accurately using CDP. Which probe must be enabled on the ISE Policy Service node to collect CDP attributes from the switches?

Accepted Answer

CDP probe. The CDP probe is designed to capture Cisco Discovery Protocol packets from network devices. These packets contain information such as the device type, platform, and software version, which ISE uses to profile endpoints. For IP phones that advertise via CDP, enabling the CDP probe on the Policy Service node is essential to collect the necessary attributes for accurate profiling.

Answer

SNMP probe

Answer

LLDP probe

Answer

RADIUS probe

Question 20

You want to improve profiling accuracy for endpoints that do not send DHCP options. You decide to use SNMP Trap profiling. What is a critical prerequisite for this to function?

Accepted Answer

The network device must be configured to send SNMP traps to the ISE PSN IP address.. SNMP Trap profiling requires the network device (switch, WLC, router) to be configured to send SNMP traps to the ISE PSN's IP address, because ISE relies on receiving those traps to extract endpoint attributes like MAC addresses, link up/down events, and CDP/LLDP neighbor data. Without the device actively sending traps to ISE, the SNMP Trap probe receives no data and profiling cannot occur.

Answer

The endpoint must support SNMP agents.

Answer

The ISE node must have the SNMP Query probe enabled.

Answer

RADIUS Accounting must be disabled.