Profiler practice questions

DHCP probe

Why it fails: DHCP provides OUI and vendor information, not CDP cache data.

RADIUS probe

Why it fails: RADIUS probe handles authentication attributes, not CDP data.

HTTP probe

Why it fails: HTTP probe is used for browser user-agent detection.

Operations > Feed Service

Why it fails: Operations does not contain feed configuration.

Administration > System > Feed Service

Why it fails: Feed service is under the Policy menu.

Policy > Policy Elements > Results

Why it fails: This is for authorization profiles.

Option 60

Why it fails: Option 60 is the Vendor Class Identifier, which is also used, but 150 is definitive for Cisco phones.

Option 12

Why it fails: Option 12 is the Host Name.

Option 55

Why it fails: Option 55 is the Parameter Request List.

Configure a manual sync between PSNs.

Why it fails: PSNs do not sync profiling data directly to each other.

Enable Database replication on each PSN.

Why it fails: This is not a configuration step for profiling.

Use the Feed Service on every PSN.

Why it fails: The Feed Service should only be managed from the PAN.

It triggers an automatic purge of endpoint cache.

Why it fails: It has no effect on cache.

It disables the probe for that policy.

Why it fails: This setting does not affect probe configuration.

It changes the priority of the policy.

Why it fails: Policy order determines priority.

Administration > Network Resources

Why it fails: Administration > Network Resources holds network device definitions and RADIUS clients, not endpoint profiling data. It is tempting as a configuration area for network access infrastructure, but Context Visibility lives under Operations, where endpoint attributes, profiling and compliance states are actually displayed.

Policy > Endpoints

Why it fails: Policy > Endpoints lists endpoint identities used in policy conditions, not the contextual attribute view. It is tempting because endpoint records are managed there, but Context Visibility specifically presents profiled attributes and posture under Operations, so this path shows configuration rather than live context.

Operations > Context Visibility

Why it fails: Operations > Context Visibility is the correct location, so this option is not incorrect. It is tempting precisely because it is right: endpoint profiling attributes, posture and compliance data are viewed there, matching the question's requirement to locate Context Visibility in Cisco ISE.

It defines the order in which probes are executed.

Why it fails: Probes run in parallel.

It sets the order of endpoint group assignment.

Why it fails: Group assignment is a result, not a process order.

It controls which PSN processes the policy.

Why it fails: This is defined by the deployment configuration.

The device must support DHCP Option 150.

Why it fails: Option 150 is for DHCP probes, not SNMP.

The device must have a static IP address.

Why it fails: SNMP query works regardless of IP assignment.

The device must be running an SNMP Agent.

Why it fails: The network switch, not the endpoint, needs the SNMP agent.

Layer 2 source MAC address.

Why it fails: MAC address is an attribute of the frame, not the DHCP option.

IP Header Source Address.

Why it fails: Not specific to DHCP probe attributes.

DHCP Option 12 (Host Name)

Why it fails: While present, these two are the standard for profiling.

They are used to define the user's role.

Why it fails: User roles are usually in User Identity Groups.

They are automatically purged every 24 hours.

Why it fails: Groups are static configuration objects.

An endpoint can belong to multiple groups simultaneously.

Why it fails: An endpoint is typically assigned to one profiled identity group.

NMAP and NetFlow

Why it fails: NMAP is resource-intensive and often blocked by firewalls; NetFlow provides traffic patterns but lacks granular device classification.

SNMP Query and RADIUS Accounting

Why it fails: SNMP requires read access which might be disabled on phones, and RADIUS accounting only provides session data, not device attributes.

CDP and DNS

Why it fails: The scenario specifies the phones do not support LLDP-MED; CDP is often similarly absent in third-party or older gear.

It is a global setting for the entire ISE deployment.

Why it fails: It is per-policy.

It is updated automatically by the Feed Service.

Why it fails: It is configured by the admin or default policy.

It can only be used with SNMP probes.

Why it fails: It applies to all attribute matches.

The endpoint identity group is full.

Why it fails: Identity groups do not have a hard cap that stops profiling; this is not a valid ISE limitation.

The Monitoring node is overloaded.

Why it fails: While performance impacts profiling, it would not cause intermittent 'Unknown' results for specific vendors only.

The Profiler Feed Service is not enabled under Administration > System > Settings.

Why it fails: This affects global updates but would impact all devices, not just specific medical devices.

Administration > System > Profiling

Why it fails: This area focuses on probe configurations and general system settings, not logic conditions.

Policy > Policy Elements > Conditions

Why it fails: This is for authorization and authentication conditions, not specific profiling logic.

Context Visibility > Endpoints

Why it fails: Context visibility is for viewing and searching; logic definition happens in the Policy menu.

The system throws a configuration error.

Why it fails: ISE is designed to handle policy hierarchies without throwing errors.

The endpoint is assigned to the 'Multiple' group.

Why it fails: There is no such group; profiling results in a single profile assignment.

The first policy created is applied.

Why it fails: ISE uses policy matching logic, not creation order.

Change the device's IP address.

Why it fails: IP changes may trigger new probes, but it is not a direct 'trigger' function for re-profiling.

Modify the endpoint's MAC address.

Why it fails: MAC addresses are unique identifiers; modifying them creates a new entry, not a re-profile.

Configure the 'ip dhcp snooping' feature on the switch to intercept DHCP packets.

Why it fails: DHCP snooping is a security feature that filters untrusted DHCP messages and builds a binding table, but it is not required for the device sensor to function. The device sensor can operate without DHCP snooping. While DHCP snooping might provide additional information, it does not directly enable the device sensor to send data to ISE. The issue is that the device sensor is not enabled on the interface.

Configure the 'device-sensor notify' command to specify ISE as the notification target.

Why it fails: The 'device-sensor notify' command is used to enable the device sensor to send updates to all interested parties, but it does not specify a target. ISE receives device sensor data through RADIUS accounting packets, not through a direct notification target. Therefore, this command does not solve the problem of ISE not receiving data. The correct action involves enabling the device sensor on the interface.

Add the 'device-sensor filter-list dhcp' command to the interface configuration.

Why it fails: The 'device-sensor filter-list dhcp' command is a global configuration command that defines which DHCP options to include in the device sensor output. It is not applied at the interface level. Repeating it on the interface would result in an error. The missing step is to enable the device sensor on the interface, not to apply the filter list there. The filter list must be referenced globally.

RADIUS probe

Why it fails: The RADIUS probe collects attributes from RADIUS authentication and accounting packets, such as the calling station ID and NAS port type. It is useful for profiling endpoints that authenticate via 802.1X or MAB, but it does not provide specific details about the phone model or capabilities. It is not the most reliable probe for detailed phone profiling.

DHCP probe

Why it fails: The DHCP probe collects attributes from DHCP packets, such as the vendor class identifier (option 60) and hostname (option 12). While it can identify Cisco IP Phones via option 60, it does not provide detailed information like the phone model or firmware version. For more reliable and detailed profiling, other probes such as CDP or LLDP are preferred because they provide richer data.

SNMP probe

Why it fails: The SNMP probe queries network devices for information using SNMP. While it can retrieve data from switches and routers, it does not directly profile endpoints like IP phones. It may provide information about the switch port to which a phone is connected, but it lacks the detailed phone-specific attributes that CDP provides. Therefore, it is not the most reliable for profiling phones.

SNMP probe

Why it fails: The SNMP probe queries switches for information from their ARP and MAC address tables, as well as CDP neighbor tables via SNMP MIBs. However, it does not directly collect CDP packets; it polls the switch for data. While SNMP can retrieve CDP neighbor information, the question asks for the probe that collects CDP attributes, which is not SNMP but a dedicated probe that listens for CDP packets.

LLDP probe

Why it fails: The LLDP probe collects attributes from Link Layer Discovery Protocol packets, which are similar to CDP but vendor-neutral. While LLDP can also provide device information, the scenario specifically asks for CDP attributes. If the phones only send CDP, the LLDP probe would not capture that data. Therefore, LLDP is not the correct probe for CDP-based profiling.

RADIUS probe

Why it fails: The RADIUS probe collects attributes from RADIUS authentication and accounting packets. It does not process CDP packets, which are Layer 2 protocol messages. CDP profiling requires a probe that can capture and analyze CDP advertisements, so the RADIUS probe is not the correct choice for collecting CDP attributes from switches.

The endpoint must support SNMP agents.

Why it fails: SNMP Trap profiling depends on network infrastructure devices (switches, controllers) sending traps about attached endpoints, not on the endpoints themselves running SNMP agents. Endpoint-side SNMP agents matter only for SNMP Query profiling, where ISE polls the endpoint directly.

The ISE node must have the SNMP Query probe enabled.

Why it fails: SNMP Trap profiling relies on the SNMP Trap probe receiving unsolicited traps from network devices; the SNMP Query probe polls devices on demand and is irrelevant to trap receipt. Query would be the prerequisite when profiling via periodic SNMP polling of switches and routers.

RADIUS Accounting must be disabled.

Why it fails: RADIUS Accounting is independent of SNMP Trap profiling; traps arrive over UDP 162 regardless of accounting state, and accounting data actually enriches profiling. Disabling accounting would be considered when troubleshooting accounting-related attributes or reducing ISE load, not as a trap prerequisite.