SkillTestPro | CCNP Security 300-715 SISE Practice Test 16

CCNP Security 300-715 SISE Practice Test 16 (Hard) - Cisco ISE Profiler Services and the Feed Service

CISCO CCNP Security Exam Logo

1 / 10

Which Cisco ISE service is primarily responsible for collecting endpoint attribute data and classifying endpoints into identity groups based on matching profiling policies?

The Profiler service

The pxGrid service, which shares contextual data between platforms rather than classifying devices itself

The Posture service, which evaluates endpoint compliance rather than classifying device type

The TACACS+ service, which handles device administration AAA rather than device classification

The Certificate Authority service, which issues certificates rather than classifying devices

The Sponsor service, which manages guest account creation rather than device classification

2 / 10

Which Cisco ISE mechanism regularly downloads updated profiling rules and OUI data from Cisco to help ISE recognize newly released device types without requiring a full software upgrade?

The posture update service, which updates compliance-checking content rather than device-profiling rules

The guest notification service, which sends guest credential notifications rather than profiling updates

The certificate revocation list distribution point, which distributes CRLs rather than profiling data

The sponsor group synchronization service, which is unrelated to profiling rule updates

The profiler feed service

The TACACS+ command set repository, which stores authorization commands rather than profiling rules

3 / 10

Which profiling data collection method passively gathers information such as source MAC address OUI and DHCP options from network traffic without directly querying the endpoint?

Passive collection via RADIUS, DHCP, and similar network probes

Active NMAP scanning exclusively, which directly queries the endpoint rather than passively observing traffic

Requiring a phone call to the helpdesk to manually classify every connecting device

SNMP query probes exclusively, which actively query the endpoint or network device rather than passively observing

Requiring the end user to submit a printed hardware inventory form for every device

Requiring a manually installed agent on every endpoint before any data can be collected at all

4 / 10

Which ISE probe would be most useful for gathering detailed operating system and open-port information about an endpoint through active scanning rather than passive observation?

The HTTP probe, which passively observes User-Agent strings rather than actively scanning ports

The NMAP probe

The RADIUS probe, which passively observes RADIUS attributes rather than actively scanning ports

The DNS probe, which passively observes DNS lookups rather than actively scanning ports

The NetFlow probe, which analyzes flow data rather than actively scanning ports directly

The DHCP probe, which passively observes DHCP options rather than actively scanning ports

5 / 10

Which profiling policy component defines the specific conditions (such as OUI range or DHCP class identifier) that an endpoint's collected attributes must match to be classified into a given endpoint profile?

The network device group's location hierarchy, which is unrelated to profiling match conditions

The guest type's maximum duration setting, which is unrelated to endpoint classification conditions

Profiling policy rules/conditions with associated certainty factors

The TACACS+ command set definition, which is unrelated to endpoint classification conditions

The certificate authentication profile's certificate field mapping, which is unrelated to profiling conditions

The sponsor group's permitted guest types setting, which is unrelated to endpoint classification

6 / 10

Which action can Cisco ISE automatically trigger once an endpoint is newly profiled or reprofiled into a different endpoint identity group, without requiring the endpoint to fully re-authenticate from scratch?

A Change of Authorization (CoA), re-evaluating the endpoint's authorization result based on its new profile

An automatic promotion of the endpoint to full ISE administrator status

An automatic and irreversible deletion of the endpoint's MAC address from all ISE databases

A permanent, unconditional ban of the endpoint from the network with no possibility of future access

An automatic enrollment of the endpoint into the guest sponsor group

An automatic conversion of the endpoint into a TACACS+ device administration client

7 / 10

Which profiler design consideration is important when deploying profiling probes across a distributed ISE deployment with multiple Policy Service Nodes (PSNs)?

Randomly enabling probes on nodes with no consideration of network topology or traffic visibility

Disabling all profiling probes entirely to simplify the deployment, since profiling provides no value

Ensuring the appropriate probes are enabled on PSNs positioned to actually observe the relevant traffic (such as DHCP or RADIUS) for accurate profiling

Enabling every possible probe on every single node regardless of whether that node can observe the relevant traffic, in most deployment scenarios, under normal operating conditions

Ensuring profiling probes are enabled exclusively on the Primary Administration Node with no other node involved

Ensuring only the Monitoring and Troubleshooting (MnT) node has any profiling probes enabled at all

8 / 10

Which outcome would likely result from profiling policies that are poorly tuned, causing many endpoints to be classified with a low certainty factor or left unclassified?

Endpoints may receive an inaccurate or overly restrictive default authorization result due to unreliable device-type identification

The network devices would automatically revert to factory default configuration in response

The endpoints would automatically be granted full unrestricted administrative access as a fallback

ISE would automatically and correctly guess the exact device type with perfect accuracy regardless of tuning, under normal operating conditions

The organization's DNS servers would automatically reconfigure themselves in response to poor profiling

The ISE deployment would automatically uninstall the profiler service entirely

9 / 10

Which combination of profiler design practices would provide accurate, low-maintenance endpoint classification for a large enterprise with a diverse mix of corporate, IoT, and medical devices?

Assuming all IoT and medical devices will automatically match existing default Cisco-provided profiles with no customization ever needed

Enabling every probe on every node with no consideration of traffic visibility or performance impact

Relying exclusively on manual, one-by-one classification of every single endpoint by an administrator

Disabling the profiler feed service permanently to avoid any external network dependency, in accordance with common design practices, which is not the standard approach, which is not the standard approach, under typical configuration conditions

Never reviewing or updating profiling policies after initial deployment regardless of new device types appearing

Enabling the appropriate probes on PSNs with relevant traffic visibility, keeping the profiler feed service updated, creating custom profiling policies for unrecognized device types, and periodically reviewing endpoint classification accuracy

10 / 10

Which statement accurately distinguishes endpoint profiling from posture assessment in Cisco ISE?

Profiling only applies to guest devices, while posture assessment only applies to sponsor accounts

Profiling and posture assessment are simply two different names for the exact same underlying ISE process with no distinction, which does not align with best practices, in accordance with common design practices

Profiling requires a persistent agent installed on the endpoint, while posture assessment never involves any client software

Posture assessment identifies device type, while profiling evaluates security compliance, which reverses their actual roles

Profiling identifies what type of device is connecting, while posture assessment evaluates whether that device complies with security requirements such as antivirus or patch status

Posture assessment is performed exclusively by the profiler feed service with no separate posture policy involved

Your score is

The average score is 0%