In a campus building the profiler labels every VoIP phone as an unknown endpoint because the policy matches only the HTTP user-agent from a web probe. The security lead wants a phone profile applied only when several independent probes support the match. Which profiling policy setting and conditions should the engineer change to raise profile certainty?

Raise the phone profile’s minimum certainty factor and add DHCP fingerprint and CDP neighbor conditions to its match. The higher threshold requires stronger evidence before the profile is assigned, and the added probes provide relevant evidence beyond the HTTP user-agent. Together, these changes make the profile depend on multiple supporting observations. Keeping the current threshold while requiring both DHCP and CDP evidence adds useful conditions, but leaves the required certainty unchanged, so the profile may still be applied without meeting a higher confidence bar. Raising the threshold while allowing either DHCP or CDP to suffice can still let one probe alone support the match, which falls short of the goal of corroboration from several independent probes. Raising the threshold and requiring both new probes while retaining the HTTP user-agent as mandatory adds a gate that may block a well-supported phone match; the scenario identifies reliance on that web-probe attribute as the problem. Exam caveat: certainty threshold and condition logic are separate controls. Requiring multiple probes can reduce matches when a probe is unavailable, whereas allowing either probe may provide less corroboration. Practical check: test representative phones and review profiler reports to verify that DHCP and CDP observations arrive, the profile reaches the configured certainty, and unrelated endpoints do not match.