Profiler (15%)

SISE · 45 questions

• A retailer is profiling printers, IP phones and cameras across 40 stores. Security wants a device labelled as an IP phone only when the combined probe evidence is strong, and weaker evidence should fall through to a catch-all profile. Which configuration detail of the profiling policy sets that bar?
• A university's ISE profiles laptops and printers well, but newly purchased VoIP phones show up as Unknown on day one. The team wants new models classified automatically as hardware ships, wants profiling policies left untouched, and still needs the probe data that authorization decisions rely on. Which profiling feature should they enable for the new VoIP models?
• A university keeps seeing unknown laptops profiled as printers when a single DHCP fingerprint matches the printer rule. The team wants a profile applied only when the strongest probe evidence clears a confidence threshold, with weaker evidence falling through to the unknown category. Which profiling policy control provides that gating in ISE?
• A 900-bed hospital must keep 40 infusion pumps matching its Medical-Devices authorization rule. The pumps roam across three floors, take addresses from several subnets, and change DHCP fingerprints after firmware updates, while the same vendor's barcode scanners share their MAC OUI. Which endpoint identity approach holds these pumps in one group?
• A hospital's medical devices sit on a VLAN whose SVI relays DHCP to a central server, and profiling must use the DHCP fingerprint plus the HTTP User-Agent string from that same VLAN. The PSN serving these sessions is 10.5.20.15. Which DHCP helper and SPAN setup feeds both profiling probes?
• A residence-hall network must profile wireless IoT sensors before they reach the building-automation VLAN. The sensors always request their address with DHCP and include a vendor class identifier and a parameter request list, but they generate no HTTP sessions, expose no SNMP service, and drop all active scans. Which ISE profiling probe supplies the attributes that identify these sensors?
• A hospital admits infusion pumps with MAB and laptops with 802.1X. After a profiler update reclassifies an admitted pump, the new authorization must apply immediately, but a reauthentication request leaves its session unchanged, the pump sits idle for minutes, and it must return to service without any manual clearing. Which CoA type should ISE send for that pump?
• A logistics warehouse uses ISE to profile 3,000 scanners, badge readers and IP cameras. Newer models keep landing in the Unknown group because the local profile list lags behind, the team has no time for manual imports, and outbound HTTPS is permitted only from ISE nodes in the services segment. The primary PAN is in that segment. Which profiling service should you turn on to keep device profiles current?
• A media studio's AV network has 40 static-addressed devices: mixers, lighting desks and display screens. They authenticate with MAB, run without SNMP, and stay silent on DHCP and HTTP. Profiling falls back to the MAC OUI and groups them as unknown, yet each device answers connection attempts on its control port. Which probe should be enabled to collect attributes that separate these device types?
• A regional hospital rolled out dozens of new biomedical monitors and digital displays this quarter, and ISE keeps dropping them into the Unknown profile because their MAC OUI prefixes and HTTP user-agent strings are new. The team edits profiling rules every week and wants updated vendor fingerprint data to arrive on its own while the switch configuration stays untouched. Which ISE capability should the team enable to keep that fingerprint data current?
• A hospital network spans twelve VLANs served by one central DHCP server, and ISE in the data center must profile those endpoints for device-based policy. Operations has ruled out SPAN sessions that mirror uplink traffic because the collector links are already saturated. Which configuration delivers DHCP probe data to ISE on every subnet?
• The ISE profiler combines evidence from DHCP, HTTP, SNMP and NetBIOS probes when it evaluates a profiling policy, and different profiles can match the same device to different degrees. Which statement correctly describes how ISE derives a profile's certainty factor?
• A regional hospital has 36 label printers whose MAC addresses are already recorded. A printer authorization rule must match a Medical Printers endpoint identity group, and that membership must hold even if a new profiling sensor later changes each printer's profile. Which ISE setting keeps each printer in the Medical Printers endpoint identity group when profiling runs again?
• On a factory floor, 60 VoIP phones register through MAB and produce only DHCP traffic, with option 60 in each request. The profile must match on that vendor class value to place the phones in the voice policy. Which profiling probe supplies the option 60 value to the policy?
• A warehouse label printer authenticates through MAB and is being moved into a quarantine policy that places it in a different VLAN with its own subnet. The printer keeps the address it already has unless the interface link drops, so the new policy alone would leave it addressing the old subnet. Which CoA action should ISE send so the printer re-learns its address in quarantine?
• An ISE profiler leaves a plant gateway unclassified even though the team's leaf profile matches on sysDescr. The gateway has a fixed address, answers SNMP queries, and keeps its web interface closed. Which probe supplies the attributes that this match needs?
• Your core switch routes three client VLANs for data, voice and printers, and ISE profiles most endpoints as Unknown. Laptops send full DHCP option 55, printers rarely renew but do send HTTP user-agent strings, and the existing DHCP server must keep serving leases. Mirrored copies can be lost at peak, so DHCP from all three client VLANs must reach ISE by relay. Which setup feeds ISE that relayed DHCP plus the printers' HTTP data?
• A hospital runs DHCP, HTTP, SNMP and NetFlow profiling probes across 4,000 endpoints, yet many bedside infusion pumps land in the Unknown profile with out-of-date vendor attribution. The pump vendor forbids active scanning of the bedside VLAN, and the engineer has no time to rewrite profiling rules. Which endpoint profiling data source should be refreshed to give ISE current context for these devices?
• In a campus building the profiler labels every VoIP phone as an unknown endpoint because the policy matches only the HTTP user-agent from a web probe. The security lead wants a phone profile applied only when several independent probes support the match. Which profiling policy setting and conditions should the engineer change to raise profile certainty?
• A factory floor runs 200 badge printers on a single VLAN. The access switches relay DHCP to two Microsoft DHCP servers, so ISE's DHCP probe never receives a copy, and profiling must settle from the first lease. Which switch change will deliver the DHCP probe data that ISE needs to profile these printers?
• After a profiling update, an office laptop and a lobby camera both need new authorization right away. The laptop's 802.1X supplicant supports reauthentication and its live session must stay up. The camera is a MAB endpoint whose firmware never re-registers unless its port link drops. Which CoA action should ISE apply to each session?
• Profiling logs in a campus building show no DHCP data from the client VLANs, whose SVIs relay only to the corporate server, and nothing at all from a legacy segment of static scanners that emit CDP and HTTP. The switch there supports only port mirroring. Which change gives ISE both missing feeds?
• A hospital has 30 infusion pumps that use MAB only, emit no DHCP or HTTP data, and do not respond to any enabled profiling probes, so profiling labels them unknown. The rule granting the medical VLAN keys on Endpoint Identity Group = Medical Devices, and access-switch ports must not change. Which endpoint identity management change places these pumps on the medical VLAN?
• A warehouse deploys barcode scanners joined by MAC authentication with no supplicant, no browser and no SNMP agent, and they only ever send DHCP requests containing vendor parameters. Profiling must classify them on the first connection, while active port scanning is blocked on that WLAN. Which probe supplies the attribute ISE should use to fingerprint the scanners?
• A logistics company runs MAB for handheld barcode scanners. When profiling finishes, ISE learns a scanner's true vendor and must push the corrected authorization to the live session right away, but the handheld must stay connected, keep its DHCP lease, and see no interruption on the port. Which CoA message should ISE send to the switch?
• A university runs profiler-based identity across its campus LAN, where probe data sorts most devices into endpoint identity groups. Four laser printers run vendor firmware that sometimes omits those attributes, and print services needs their endpoint records to sit in the Legacy-Printers group for reporting. Which endpoint assignment approach keeps that group stable?
• A logistics warehouse runs MAB for 600 handheld scanners and label printers whose access ports carry no supplicant traffic. ISE receives only the device MAC address in the RADIUS request, so every device falls into the Unknown profile and lands in the quarantine VLAN. The scanners obtain addresses from DHCP and broadcast hostname and vendor-class data. Which profiling feed must reach ISE so its rules can use that broadcast evidence?
• A retail chain's stockroom connects wired label printers through MAB, and ISE has just re-profiled the fleet into the printer category. The printers must pick up addresses from the new printer scope, each port serves a single printer, and the link must recover with no technician on site. Which CoA action should ISE send so the printers take on the new profile and refresh their addresses?
• A retail chain's Layer 3 access switch serves 60 VoIP phones and badge readers on VLAN 130. The DHCP server sits in the central data center on another subnet, no ip helper-address is configured yet, and every lease must be relayed there while ISE receives only standard RADIUS attributes from the switch. Which configuration both keeps leases central and feeds the DHCP hostname and vendor-class options to the ISE profiler?
• A hospital profiles IP cameras and VoIP phones with ISE. The camera profile currently matches only the HTTP user-agent, but the cameras stop sending HTTP after they are installed. Which profiling design keeps the assigned certainty factor reliable for these endpoints?
• A hospital placed 300 unmanaged infusion pumps and label printers on a monitoring VLAN. They get static addresses, ignore SNMP queries, send no web traffic, and skip 802.1X, yet each model exposes a different set of open TCP ports. Which probe should supply the profiling attributes for these devices?
• A university profiles thousands of BYOD laptops, and many match one broad condition that labels them as Cisco IP phones with a low certainty factor, feeding them into the wrong authorization rule. Which profiler policy control should be used so weak evidence leaves endpoints Unknown?
• A warehouse deployed 60 handheld barcode scanners, but the ISE profiler places them in the Printers endpoint identity group because their DHCP fingerprint matches that template. Policy requires every scanner to land in the Handheld Devices group before authorization rules run, and the profiler must never move them afterward. Which endpoint identity management approach guarantees that group membership?
• A city library runs ISE across twelve branches. The self-service kiosks all use one MAC range, but after firmware updates the profiler labels them printer one week and unmanaged device the next, so they drift between endpoint identity groups. Both the circulation access rule and the monthly asset report read the endpoint identity group Kiosks, so membership must hold across profiling cycles. Which assignment method pins every kiosk to that group?
• A warehouse has profiled scanners and IP phones correctly for years, but a new shipment of handhelds from a second vendor lands in the generic default profile. The team wants ISE to recognize new hardware when Cisco publishes matching profile updates, without anyone hand-editing classifier rules for every model. Which profiler capability should they enable?
• A state university's campus network gains new printer, sensor and lab-device models every term, yet its profiling rules still recognize most of them only by MAC prefix and sort them into a generic profile. The team wants the knowledge base to keep pace with vendors without staff upkeep, SNMP replies from the instrument subnet fail to reach ISE, and ISE can reach Cisco's update servers. Which profiling feature should the team enable to raise classification accuracy?
• A warehouse runs ISE with profiling enabled. A Cisco VoIP handset with an active call is re-profiled into a new authorization profile, and the switch can reauthenticate it. A label printer found on the wrong VLAN ignores reauthentication but re-enters authentication after a port bounce. A quarantined scanner must have its live session ended at the switch instead of being re-admitted under another profile. Which CoA action applies to each endpoint?
• A clinic network runs a central ISE policy service node in the data center, and profiling must classify printers and IP phones across twelve access switches. Both SPAN destination ports on every access switch are already used by the network analyzer, the routed client interfaces on the distribution layer already relay DHCP to a remote server, and the profiler needs DHCP option fingerprints plus the printer HTTP user-agent strings. Which probe and helper design should be configured for the ISE profiler?
• A campus ISE deployment classifies VoIP phones correctly, but a new batch of laser printers lands in the Unknown profile because the DHCP fingerprint selector matches only a few of them. The access team wants higher confidence before granting printing access. Which profiling change should the engineer make first?
• A county hospital's profiler labels infusion pumps and tablets as unknown because its policies match only on the MAC OUI. The team wants the browser and OS string a device advertises in an unencrypted HTTP request, so profiles can match on that value instead. Which probe supplies that profiling attribute?
• At a university engineering lab, ISE profiles wired endpoints behind Cisco switches. A conference IP phone has been recategorized and needs a new dACL on its existing session, an access point must switch from MAB to 802.1X, and a laptop tied to an incident must have its live session ended immediately. Which CoA action fits each of the three cases?
• A logistics warehouse added IP cameras from a vendor that ISE has never seen, so they profile as generic printers and land in the printer VLAN. The security lead wants new device types and MAC maker prefixes to arrive from Cisco on a schedule rather than the team hand-writing rules each quarter. Which ISE feature delivers those profiling updates?
• A campus network engineer is tuning the ISE profiler for a lab subnet holding 40 laser printers and 300 workstations. The printers send only plain address requests, nobody browses to them, and their SNMP community is unknown, but they do accept TCP connections on ports 9100 and 515. Which probe should the engineer enable so the printers match a profile?
• In a warehouse, label printers and handheld scanners both land in the generic endpoint profile, so the printer-only authorization rule stays untested. The scanners must stay out of the printer profile. Only DHCP and SNMP data reach ISE for these label printers, with HTTP and DNS data absent. Which profiling policy change gives the printer profile enough certainty to win?
• A hospital has 40 infusion pumps that must always match an authorization rule keyed on a restricted endpoint identity group, because moving them breaks the clinical VLAN policy. During a firmware rollout the profiler sees incomplete DHCP data for these devices. Which endpoint identity assignment keeps the group membership stable?