300-715 Question #199: Real Exam Question with Answer & Explanation

Question

An organization has a fully distributed Cisco ISE deployment. When implementing probes, an administrator must scan for unknown endpoints to learn the IP-to-MAC address bindings. The scan is complete on one FPSN, but the information is not available on the others. What must be done to make the information available?

Options

• AScanning must be initiated from the PSN that last authenticated the endpoint
• BCisco ISE must learn the IP-MAC binding of unknown endpoints via DHCP profiling, not via
• CScanning must be initiated from the MnT node to centrally gather the information
• DCisco ISE must be configured to learn the IP-MAC binding of unknown endpoints via RADIUS

Explanation

Given below is additional information related to the manual NMAP scan results: - To detect unknown endpoints, NMAP should be able to learn the IP/MAC binding via NMAP or a supporting SNMP scan. - ISE learns IP/MAC binding of known endpoints via Radius authentication or DHCP profiling. - The IP/MAC bindings are not replicated across PSN nodes in a deployment. Therefore, you must trigger the manual scan from the PSN, which has the IP/MAC binding in its local database (for example, the PSN against which a mac address was last authenticated with). - The NMAP scan results do not display any information related to an endpoint that NMAP had previously scanned, manually or automatically. 4/admin_guide/reorg/b_endpoint_profiling_2_4.html#concept_57A4A7ADE3DA429A821900C5C

No community discussion yet for this question.