300-715 · Question #70
An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling…
The correct answer is D. The default profiler configuration is set to No CoA for the reauthentication setting. The default Cisco ISE profiler configuration does not automatically trigger a Change of Authorization (CoA) when a device's profile changes, preventing immediate access updates.
Question
An administrator enables the profiling service for Cisco ISE to use for authorization policies while in closed mode. When the endpoints connect, they receive limited access so that the profiling probes can gather information and Cisco ISE can assign the correct profiles. They are using the default values within Cisco ISE, but the devices do not change their access due to the new profile. What is the problem?
Options
- AIn closed mode, profiling does not work unless CDP is enabled.
- BThe profiling probes are not able to collect enough information to change the device profile
- CThe profiler feed is not downloading new information so the profiler is inactive
- DThe default profiler configuration is set to No CoA for the reauthentication setting
How the community answered
(28 responses)- A4% (1)
- B4% (1)
- C11% (3)
- D82% (23)
Why each option
The default Cisco ISE profiler configuration does not automatically trigger a Change of Authorization (CoA) when a device's profile changes, preventing immediate access updates.
CDP (Cisco Discovery Protocol) is a useful profiling probe, but profiling can work in closed mode with other probes even if CDP is not enabled.
The question implies that profiling occurs and profiles are assigned, so the problem is not the lack of information gathering but the lack of action based on new profiles.
The scenario states that profiles are assigned, indicating the profiler is active and receiving information, thus the feed being inactive is not the issue.
By default, Cisco ISE's profiler configuration for reauthentication is set to 'No CoA'. This means that even if a device's profile is successfully updated after profiling, ISE will not automatically send a CoA message to the Network Access Device (NAD) to force a reauthentication or apply new access policies. The device will maintain its initial limited access until its session expires or is manually reauthenticated.
Concept tested: Cisco ISE Profiler Change of Authorization (CoA)
Source: https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ise_admin_guide_3_0/b_ise_admin_guide_3_0_chapter_01001.html#concept_3C523B5A81774026B93F421D5D44C571
Topics
Community Discussion
No community discussion yet for this question.