Which two Cisco ISE components enforce security policies on noncompliant endpoints by blocking network access? (Choose two.)

Apex licensing is a tier of Cisco ISE licensing that enables advanced features like posture, but it is not a component that directly enforces security policies.

TACACS+ is an authentication, authorization, and accounting (AAA) protocol primarily used for device administration access, not for enforcing network access policies on user endpoints.

Profiling allows ISE to categorize endpoints based on collected attributes; if an endpoint's profile indicates non-compliance with network access policies, ISE can apply restrictions or block access.

DHCP and SNMP probes are mechanisms used by ISE to *collect* endpoint attributes for profiling, not components that *enforce* security policies by blocking access.

Posture agents, such as the Cisco AnyConnect client, run on endpoints to collect real-time security state information (e.g., anti-virus definitions, OS updates) and report non-compliance to ISE, which then enforces policy, including blocking network access.