An administrator is configuring new probes to use with Cisco ISE and wants to use metadata to help profile the endpoints. The metadata must contain traffic information relating to the endpoints instead of industry-standard protocol information Which probe should be enabled to meet these requirements?

The NetFlow probe is designed to collect traffic flow data from NetFlow-enabled network devices. This data includes details like source/destination IP addresses, source/destination ports, and protocols used in communications. This information constitutes "traffic information" as it describes the endpoint's actual communication patterns and behavior on the network. This is distinct from other probes that extract static attributes directly from specific protocol fields (e.g., DHCP options), which aligns with the question's requirement to use traffic information instead of standard protocol information for profiling.

B. DNS probe: This probe collects Fully Qualified Domain Name (FQDN) information from DNS lookups. This is specific protocol information, not a summary of general traffic flows.
C. DHCP probe: This probe collects attributes directly from DHCP protocol packets, such as the vendor class identifier (Option 60) or parameter request list (Option 55). This is a prime example of "industry-standard protocol information," which the question explicitly seeks to avoid.
D. SNMP query probe: This probe actively polls network devices or endpoints for management information (e.g., LLDP/CDP neighbors, interface statistics). This is management protocol data, not end-user traffic flow information.

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Probes" section:

NetFlow Probe: "The NetFlow probe collects NetFlow packets from a NetFlow-enabled network device. Cisco ISE uses the information from the NetFlow packets to profile endpoints. The NetFlow probe collects information about the traffic that flows from an endpoint

such as the protocol and the port that is used by the endpoint." This confirms NetFlow provides traffic flow information.

DHCP Probe: "The DHCP probe collects endpoint attributes from DHCP requests that are sent to a DHCP server. The DHCP probe parses each packet and creates an endpoint in the Cisco ISE database if one does not exist." This confirms the DHCP probe focuses on protocol-specific attributes.

DNS Probe: "The DNS probe enables Cisco ISE to look up the FQDN of an endpoint when it receives a syslog message for a DNS request from a DNS server." This confirms the DNS probe's focus on name resolution protocol data.

SNMP Query Probe: "The SNMP Query probe polls network devices for data about endpoints that are connected to them." This confirms the SNMP probe's role in gathering management protocol data.