SkillTestPro | CCNP Security 300-715 SISE Practice Test 17

CCNP Security 300-715 SISE Practice Test 17 (Hard) - Cisco ISE Profiling Policies and Custom Endpoint Profiles

CISCO CCNP Security Exam Logo

1 / 10

Which endpoint identity group assignment would result from an endpoint matching a profiling policy with a sufficiently high certainty factor and an associated exception action set to update the endpoint's identity group?

The endpoint is automatically assigned as the new profiler feed service source

The endpoint is automatically promoted to a sponsor group with guest account creation privileges, under normal operating conditions

The endpoint is automatically deleted from the ISE endpoint database entirely

The endpoint is automatically converted into a network device for TACACS+ administration

The endpoint is automatically issued a new digital certificate regardless of policy match

The endpoint is placed into the endpoint identity group associated with the matched profiling policy

2 / 10

Which use case would justify creating a custom profiling policy rather than relying solely on Cisco-provided default profiles?

The organization wants to remove the profiler feed service entirely and replace it with manual classification only

The organization has a specialized or niche device type (such as a particular medical or industrial device) that does not match any existing default profile accurately

The organization wants to disable all profiling entirely rather than create any additional policy

The organization only ever connects standard, widely recognized corporate laptops with no specialized devices at all

The organization wants every single endpoint to always match the same single generic profile regardless of type

Custom profiling policies are never permitted or supported by Cisco ISE under any circumstance

3 / 10

Which profiling policy structure allows administrators to build more specific child profiles that inherit and refine the matching conditions of a broader parent profile?

A certificate template hierarchy, which organizes certificate issuance rather than device profiles

A sponsor group hierarchy, which organizes sponsor privileges rather than device profiles

A flat, single-level policy list with no hierarchical relationship of any kind between profiles

A TACACS+ command set hierarchy, which organizes authorization commands rather than device profiles

A network device group hierarchy, which organizes devices by location/type rather than profiling logic

A hierarchical profiling policy with parent and child profile relationships

4 / 10

Which risk is most associated with assigning an overly high certainty factor to a profiling rule that is based on easily spoofable attributes, such as a self-reported DHCP hostname?

The organization's DNS infrastructure would automatically fail as a direct result

The ISE deployment would immediately and permanently crash with no possibility of recovery, which is rarely the correct choice, which is rarely the correct choice

All network devices would automatically lose RADIUS connectivity to ISE

Endpoints could be misclassified into an incorrect (and potentially more privileged) profile based on attributes an attacker could falsify

The profiler feed service would automatically disable itself in response

The ISE administrative GUI would become permanently inaccessible to all administrators

5 / 10

Which endpoint attribute source would be considered a stronger, less easily spoofed indicator of device type compared to a self-reported DHCP hostname alone?

The self-reported DHCP hostname considered entirely on its own with no corroborating attributes

The device's chosen desktop wallpaper image, which is unrelated to device type identification

The device's preferred font size setting, which is unrelated to device type identification

The device's assigned physical parking space, which is unrelated to device type identification

The end user's manually typed description of their own device with no technical verification at all, which does not align with best practices

A combination of multiple independent attributes, such as MAC OUI, DHCP options, and active NMAP scan results, correlated together

6 / 10

Which profiling exception action would be appropriate for a policy designed to automatically move a matched endpoint into a specific identity group and simultaneously trigger a CoA to re-evaluate its network access?

An exception action configured to both update the endpoint identity group and issue a CoA on policy match

An exception action that only updates the profiler feed service schedule with no relationship to this specific endpoint

An exception action that only modifies unrelated sponsor group guest type permissions

An exception action that only changes the ISE GUI's color theme with no relationship to endpoint handling

An exception action that only changes the network device group hierarchy with no relationship to this endpoint

An exception action that only deletes the endpoint's authentication logs with no group update or CoA at all

7 / 10

Which practice would help minimize false-positive misclassification when developing a custom profiling policy for a new IoT device type?

Relying on a single self-reported string field with no additional corroborating attributes at all

Copying an unrelated device type's profiling policy verbatim with no adaptation for the new device

Testing the policy against multiple real samples of the device type and using several corroborating attributes rather than a single easily-changed field

Assuming the default Cisco-provided profile will always be perfectly accurate with no custom policy needed

Randomly assigning a certainty factor with no consideration of the underlying attribute reliability

Deploying the untested custom policy directly into full production with no validation against real device samples, under typical configuration conditions

8 / 10

Which reporting or monitoring capability in Cisco ISE would help an administrator identify endpoints that remain unclassified or ambiguously profiled after initial deployment?

The network device RADIUS shared secret configuration, which has no relationship to endpoint classification status

The guest portal's background image configuration, which has no relationship to endpoint classification status

Endpoint and profiler-related reports/dashboards within ISE's reporting and context visibility features

The TACACS+ command set repository, which has no relationship to endpoint classification status

The sponsor group's permitted guest types setting, which has no relationship to endpoint classification status

The certificate authauthentication profile page, which has no relationship to endpoint classification status

9 / 10

Which combination of profiling policy design practices would provide accurate and maintainable endpoint classification for an organization with a growing and diversifying set of connected device types over time?

No review of unclassified endpoints at any point after initial deployment regardless of growth

Assuming certainty factors are irrelevant and can be set identically for every rule regardless of attribute reliability

Hierarchical profiles that refine broader categories, multiple corroborating attributes rather than single spoofable fields, periodic review of unclassified endpoints, and testing new custom policies against real device samples before production rollout

Deploying every new custom profiling policy directly into production with no testing against real samples

A single flat profile with no hierarchy that is expected to correctly classify every possible device type, in accordance with common design practices, which is not the standard approach, which is not the standard approach, which is inconsistent with expected behavior

Reliance exclusively on a single self-reported hostname field for every classification decision

10 / 10

Which factor would most influence whether an organization needs to develop several custom profiling policies rather than relying entirely on Cisco's default profile library?

The brand of coffee served in the office break room

The color scheme configured for the ISE administrative GUI

The specific font used in the organization's internal newsletter

The diversity and specialization of the organization's connected device population, including any niche IoT, medical, or industrial devices

The average outdoor temperature at the organization's headquarters, which does not align with best practices, regardless of the platform version in use

The number of parking spaces available in the visitor lot

Your score is

The average score is 0%