A network is going through major hardware upgrades and is using Cisco ISE for network access control. Network devices are being added and removed regularly and the Cisco ISE administrators want to…

DHCP SPAN involves mirroring DHCP traffic for profiling endpoints, which is less efficient for real-time tracking of new device additions or removals compared to event-driven SNMP traps.

SNMP query involves Cisco ISE actively polling devices, which is less efficient for detecting and tracking newly added devices in real-time than reactive SNMP traps.

SNMP traps are the most effective probe for tracking new network devices because they provide event-driven notifications to Cisco ISE when devices connect, disconnect, or undergo status changes. This allows ISE to receive real-time updates about device presence and update its endpoint database accordingly, enhancing visibility.

NetFlow provides data on network traffic flows, useful for analytics and anomaly detection, but not directly for identifying and tracking the addition or removal of network devices.