What gives Cisco ISE an option to scan endpoints for vulnerabilities?

What gives Cisco ISE an option to scan endpoints for vulnerabilities?
A. authentication policy
B. authorization profile
C. authentication profile
D. authorization policy