300-715 · Question #32
Which of these is not a method to obtain Cisco ISE profiling data?
The correct answer is D. active scans. Cisco ISE gathers profiling data from passive network sources like RADIUS, HTTP, SNMP, Netflow, and DNS, but it does not primarily rely on active network scans for profiling.
Question
Which of these is not a method to obtain Cisco ISE profiling data?
Options
- ARADIUS
- BHTTP
- CSNMP query
- Dactive scans
- ENetflow
- FDNS
How the community answered
(62 responses)- B2% (1)
- D95% (59)
- F3% (2)
Why each option
Cisco ISE gathers profiling data from passive network sources like RADIUS, HTTP, SNMP, Netflow, and DNS, but it does not primarily rely on active network scans for profiling.
RADIUS authentication and accounting messages provide valuable endpoint attributes, such as calling-station-ID and service-type, for profiling.
HTTP User-Agent strings, hostnames, and HTTP application attributes collected via HTTP probes contribute to endpoint profiling.
SNMP queries to network devices can provide information about connected endpoints, such as MAC addresses, interface descriptions, and host details, for profiling.
Cisco ISE profiling is primarily a passive monitoring process that collects attributes from various network protocols and services; it does not perform active network scanning to gather profiling data from endpoints.
Netflow records provide traffic patterns and details about applications and protocols used by endpoints, which can be used to identify device types and behavior for profiling.
DNS requests and responses reveal hostname information which is crucial for identifying endpoints and their operating systems for profiling.
Concept tested: Cisco ISE Profiling Data Sources
Source: https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ISE_admin_3_1/m_profiling.html
Topics
Community Discussion
No community discussion yet for this question.