A retailer is profiling printers, IP phones and cameras across 40 stores. Security wants a device labelled as an IP phone only when the combined probe evidence is strong, and weaker evidence should fall through to a catch-all profile. Which configuration detail of the profiling policy sets that bar?
Select an answer to reveal the explanation.
Short Explanation
Your probe evidence rolls up into a score, and the certainty factor is the bar that score has to clear. Raise it and only strong, multi-source evidence earns the IP phone label. It's like a scale that only tips once enough weight is on it.
Full Explanation
The profiler accumulates evidence from DHCP, SNMP, HTTP and DNS probes, and every condition a profile policy matches adds to a certainty score for that profile. The certainty factor on the policy rule is the bar that score must reach, so raising it means only strong, multi-source evidence earns the IP phone label while thin evidence falls to the catch-all. Rule and condition order decide which policy rule is selected first rather than how confident the outcome is, so ordering cannot set the required strength. The endpoint identity group mapping happens after a profile is chosen, so it drives later authorization rather than how much evidence the classification needs. The probe allow list governs which protocol handlers may feed attributes into the profiler, which changes what evidence exists, not what strength is required. Exam caveat: shipped profile policies come with their own certainty values, so answer from the field that sets the bar instead of a memorized default. Practical check: open the endpoint's profiling details in ISE and confirm the combined certainty of the matched conditions clears the value you configured.