Cisco ISE Components for Noncompliant Endpoint Enforcement
Which two Cisco ISE components enforce security policies on noncompliant endpoints by blocking network access? (Choose two.)
Answer
Correct answer: C, E — Profiling identifies the device type and Posture agents assess compliance to enforce access blocks on noncompliant endpoints.
Community Insight
The exam tests whether you can distinguish between device identification (profiling) and compliance enforcement (posture), avoiding the trap of selecting licensing requirements as functional components.
This question tests the specific Cisco Identity Services Engine (ISE) components responsible for blocking network access to noncompliant endpoints, focusing on the distinction between profiling and posture.
Many learners select Apex licensing because it is a prerequisite for the Posture feature, but licensing is not a technical component that enforces policies; they also sometimes confuse Profiling with Posture.
Community Discussion (15 comments)
XBfoundX
👍 1
Selected: CE
At this point I am going with C and E. Even if for sure, Apex Licesing, is needed for posturing, is not a component that can enforce security policies. They are not asking if our ISE have licensing active or not, they are asking which compontents of ISE enforce policies. Profiling: Device profiling allows administrators to enforce policies tailored to specific device types, such as IoT devices, mobile phones, and laptops. Posture: Device Posture Enforcement: Ensures that endpoints comply with security policies before gaining access to the network. By integrating these components, Cisco ISE provides a robust framework for managing network security at scale.
7d4c29f
👍 1
Selected: CE
Both Profiling and Posture Agents are Cisco ISE components that directly identify and enforce security policies on noncompliant endpoints by blocking or restricting network access.
Silexis
👍 2
Selected: CE
Profiling can be used to enforce compliance without posturing. An example is the profiling of an endpoint OS in order to see if it falls into the allowed OS. Profiling can also do the job where an endpoint is not capable to run a posture agent - ex an IP camera. There is no longer Apex in Cisco ISE and the licensing part is not a component of a system, but rather an entitlement to use a specific component.
skytiger
👍 1
Selected: AE
Go for A&E. Posture requires Secure Client Premier (ex-APEX) as well as Posture Agents. Profiling is not required at all for posturing devices
XvidalX
👍 3
Selected: AE
CORRECT A and E , B - TACACS not used in posture C - profiling is not used in posture D - Probes are used in profiling
HercJ
👍 4
Selected: CE
Question is not about requirements for posture!!! profiling can also do this
LTLnetworker
👍 1
'noncompliant' clearly indicates posture, not profiling
cyberwhizzy0
👍 1
Selected: AE
Below is a list of the most notable functionality you are entitled to when using Apex licenses. Device Posturing (endpoint compliance and remediation for MacOS X and Windows) https://www.google.com/amp/s/www.lookingpoint.com/blog/cisco-ise-licensing%3fhs_amp=true
unclemonkeyboy
👍 4
Selected: CE
APEX licensing is required for 802.1x and Posturing. But it isn't a component.
Kromwall
👍 4
Selected: CE
Answer is C and E The two Cisco ISE components that enforce security policies on noncompliant endpoints by blocking network access are profiling and posture agents. Profiling is the process of identifying the type of device that is attempting to connect to the network. This is done by analyzing the device's MAC address, IP address, and other characteristics. Once the device has been profiled, it can be assigned to a specific security policy. Posture agents are software that is installed on endpoints. They monitor the endpoint's security posture and report back to ISE. If the endpoint is found to be noncompliant, ISE can block its access to the network.
SegaMasterSystemAdmin
👍 3
Selected: CE
C and E. This is not a licensing exam so not going with A
amtf8888
👍 3
Selected: AE
I'd go with A & E. POSTURE Feature require apex license
stalkr3
👍 2
Question is not about requirements for posture
4000000
👍 4
Apex licensing itself does not "enforce" the block but it facilitates the function.... So answer is correct
Mjestic
👍 6
Selected: AE
I'd go with A & E. Apex licensing is needed to do Posture Compliance on ISE. Profiling is not related to posture.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct options are Profiling and Posture agents. In Cisco ISE, Profiling identifies the type of device (e.g., iOS, Android, Printer) based on attributes like MAC OUI or DHCP fingerprints. If a policy requires devices to be compliant, ISE uses Posture Agents installed on the endpoint to assess its health (e.g., antivirus status, patch level). If an endpoint is identified via profiling but fails posture checks, or if it is a device type that cannot run an agent, ISE blocks access based on these combined inputs.Why the Other Options Are Wrong
Apex licensing (Option A) is a license tier required to enable the Posture feature, but it is not a "component" that actively enforces security policies; it is an entitlement. TACACS+ (Option B) is used for administrative access control to network devices, not for endpoint network access enforcement. DHCP and SNMP probes (Option D) are passive monitoring tools used by the Profiler to gather data for classification, not for enforcing access blocks.Community Comment Notes
Community discussion is split between AE and CE. User Mjestic argues for A and E, stating "APEX licensing is needed to do Posture Compliance," which conflates requirement with function. User unclemonkeyboy correctly notes, "APEX licensing is required... But it isn't a component." User Silexis points out that "Profiling can be used to enforce compliance without posturing," highlighting that profiling itself can trigger access decisions based on device type, making C a valid answer alongside E.Exam Strategy
When asked for 'components' in Cisco exams, distinguish between software features/hardware parts and licensing/requirements. Always prioritize the active mechanism (Posture Agent) and the identification mechanism (Profiling) over the license that enables them.
Frequently Asked Questions
Why is Apex licensing not a correct answer?
Licensing is an entitlement or prerequisite to enable features, not a technical component that actively performs actions like blocking access.
Can Profiling enforce security policies alone?
Yes, Profiling can enforce policies based on device type (e.g., blocking all printers), even without Posture agents running on the endpoint.