IP phones, printers and badge cameras on a campus cannot run an 802.1X supplicant. Cisco ISE must still place each type into the correct VLAN or apply the correct dACL automatically. Which ISE capability makes this possible?
Select an answer to reveal the explanation.
Short Explanation
If a device can't tell you who it is, you watch how it behaves. Profiling sniffs things like DHCP options and CDP or LLDP announcements to say "that's a printer" or "that's a phone". Posture and BYOD sound helpful, but they need an agent or a user that these devices just don't have.
Full Explanation
Cisco ISE profiling collects attributes about endpoints from probes, including DHCP options such as the vendor class and hostname, CDP and LLDP advertisements forwarded by the switch through RADIUS accounting, RADIUS attributes, HTTP user agents, and network scans. It matches those attributes against profiling policies to assign a profile such as an IP phone or a particular printer family. Authorization rules can then use the endpoint profile as a condition to return a specific VLAN, dACL or SGT, usually combined with MAB as the authentication method. Posture assessment requires an agent such as Secure Client on the endpoint, which phones, printers and cameras cannot run. BYOD onboarding is a user-driven process for smartphones and laptops that provisions a certificate and supplicant; headless devices have neither a user nor a supplicant. Creating sponsored guest accounts for devices is a guest-user workflow, not a device classification mechanism, and would not scale. Exam caveat: profiling identifies a device type, not its legitimacy, so an attacker who spoofs the attributes can be misclassified; restrictive per-profile authorization limits that risk. Operational check: review the endpoint's profile and collected attributes in ISE context visibility.