Cisco ISE Components for Noncompliant Endpoint Enforcement

350-701 By islever Editorial Last updated

Configure network access control mechanisms such as 802.1X and MAB with Cisco Identity Services Engine

Short answer

CE Profiling identifies the device type and Posture agents assess compliance to enforce access blocks on noncompliant endpoints.

Question

Which two Cisco ISE components enforce security policies on noncompliant endpoints by blocking network access? (Choose two.)
  1. Apex licensing
  2. TACACS+
  3. profiling Correct Answer
  4. DHCP and SNMP probes
  5. posture agents Correct Answer

Key Takeaways

The exam tests whether you can distinguish between device identification (profiling) and compliance enforcement (posture), avoiding the trap of selecting licensing requirements as functional components.

This question tests the specific Cisco Identity Services Engine (ISE) components responsible for blocking network access to noncompliant endpoints, focusing on the distinction between profiling and posture.

Common mistake: Many learners select Apex licensing because it is a prerequisite for the Posture feature, but licensing is not a technical component that enforces policies; they also sometimes confuse Profiling with Posture.

Expert Analysis

Why the Answer Is Correct

The correct options are Profiling and Posture agents. In Cisco ISE, Profiling identifies the type of device (e.g., iOS, Android, Printer) based on attributes like MAC OUI or DHCP fingerprints. If a policy requires devices to be compliant, ISE uses Posture Agents installed on the endpoint to assess its health (e.g., antivirus status, patch level). If an endpoint is identified via profiling but fails posture checks, or if it is a device type that cannot run an agent, ISE blocks access based on these combined inputs.

Why the Other Options Are Wrong

Apex licensing (Option A) is a license tier required to enable the Posture feature, but it is not a "component" that actively enforces security policies; it is an entitlement. TACACS+ (Option B) is used for administrative access control to network devices, not for endpoint network access enforcement. DHCP and SNMP probes (Option D) are passive monitoring tools used by the Profiler to gather data for classification, not for enforcing access blocks.

Community Comment Notes

Community discussion is split between AE and CE. User Mjestic argues for A and E, stating "APEX licensing is needed to do Posture Compliance," which conflates requirement with function. User unclemonkeyboy correctly notes, "APEX licensing is required... But it isn't a component." User Silexis points out that "Profiling can be used to enforce compliance without posturing," highlighting that profiling itself can trigger access decisions based on device type, making C a valid answer alongside E.

Exam Strategy

When asked for 'components' in Cisco exams, distinguish between software features/hardware parts and licensing/requirements. Always prioritize the active mechanism (Posture Agent) and the identification mechanism (Profiling) over the license that enables them.

Frequently Asked Questions

Why is Apex licensing not a correct answer?

Licensing is an entitlement or prerequisite to enable features, not a technical component that actively performs actions like blocking access.

Can Profiling enforce security policies alone?

Yes, Profiling can enforce policies based on device type (e.g., blocking all printers), even without Posture agents running on the endpoint.

More 350-701 FAQ →

Discussion 15 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 15

  1. Mjestic 👍 6
    I'd go with A & E. Apex licensing is needed to do Posture Compliance on ISE. Profiling is not related to posture.
  2. Kromwall 👍 4
    Answer is C and E The two Cisco ISE components that enforce security policies on noncompliant endpoints by blocking network access are profiling and posture agents. Profiling is the process of identifying the type of device that is attempting to connect to the network. This is done by analyzing the device's MAC address, IP address, and other characteristics. Once the device has been profiled, it can be assigned to a specific security policy. Posture agents are software that is installed on endpoints. They monitor the endpoint's security posture and report back to ISE. If the endpoint is found to be noncompliant, ISE can block its access to the network.
  3. 4000000 👍 4
    Apex licensing itself does not "enforce" the block but it facilitates the function.... So answer is correct
  4. unclemonkeyboy 👍 4
    APEX licensing is required for 802.1x and Posturing. But it isn't a component.
  5. HercJ 👍 4
    Question is not about requirements for posture!!! profiling can also do this
Show 10 more comments
  1. XvidalX 👍 3
    CORRECT A and E , B - TACACS not used in posture C - profiling is not used in posture D - Probes are used in profiling
  2. SegaMasterSystemAdmin 👍 3
    C and E. This is not a licensing exam so not going with A
  3. amtf8888 👍 3
    I'd go with A & E. POSTURE Feature require apex license
  4. Silexis 👍 2
    Profiling can be used to enforce compliance without posturing. An example is the profiling of an endpoint OS in order to see if it falls into the allowed OS. Profiling can also do the job where an endpoint is not capable to run a posture agent - ex an IP camera. There is no longer Apex in Cisco ISE and the licensing part is not a component of a system, but rather an entitlement to use a specific component.
  5. stalkr3 👍 2
    Question is not about requirements for posture
  6. XBfoundX 👍 1
    At this point I am going with C and E. Even if for sure, Apex Licesing, is needed for posturing, is not a component that can enforce security policies. They are not asking if our ISE have licensing active or not, they are asking which compontents of ISE enforce policies. Profiling: Device profiling allows administrators to enforce policies tailored to specific device types, such as IoT devices, mobile phones, and laptops. Posture: Device Posture Enforcement: Ensures that endpoints comply with security policies before gaining access to the network. By integrating these components, Cisco ISE provides a robust framework for managing network security at scale.
  7. cyberwhizzy0 👍 1
    Below is a list of the most notable functionality you are entitled to when using Apex licenses. Device Posturing (endpoint compliance and remediation for MacOS X and Windows) https://www.google.com/amp/s/www.lookingpoint.com/blog/cisco-ise-licensing%3fhs_amp=true
  8. 7d4c29f 👍 1
    Both Profiling and Posture Agents are Cisco ISE components that directly identify and enforce security policies on noncompliant endpoints by blocking or restricting network access.
  9. skytiger 👍 1
    Go for A&E. Posture requires Secure Client Premier (ex-APEX) as well as Posture Agents. Profiling is not required at all for posturing devices
  10. LTLnetworker 👍 1
    'noncompliant' clearly indicates posture, not profiling

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide