An animal-control HQ wants fabric edges to enforce Scalable Group Tags that reflect how each endpoint authenticated. Which companion platform normally classifies those endpoints into SGTs for the fabric to consume?
Select an answer to reveal the explanation.
Short Explanation
The fabric is great at carrying and enforcing tags, but something still has to decide which badge each device earns. That classifier is ISE during auth—802.1X, MAB, whatever you use. ISE hands back the SGT, and the fabric policy plane consumes it instead of guessing from NetFlow or multicast.
Full Explanation
Animal-control HQ fabric edges should enforce SGTs that reflect how each endpoint authenticated. Cisco ISE assigns those SGTs during authentication/authorization so the fabric policy plane can classify and enforce group-based access. ISE is the civic identity policy engine paired with SD-Access for dynamic SGT assignment.
A standalone NetFlow collector inventing SGTs from export templates alone observes traffic; it does not authorize endpoints into security groups at connect time.
The underlay rendezvous point stamping SGTs from multicast group addresses confuses PIM RP functions with TrustSec classification.
vManage Application-Aware Routing mapping DSCP into SGTs mixes SD-WAN SLA steering with campus SGT assignment—different products and planes.
Exam caveat: static SGT assignment exists for exceptions, but dynamic ISE-based assignment is the scalable exam-and-operations answer for user/device identity.
Operational check: authenticate a badge-attached workstation to ISE, confirm SGT on the edge/Authorization profile, and verify policy enforcement counters. Document the ISE-pxGrid/TrustSec integration in the animal-control security design. In municipal operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the platform code and policy revisions used by the civic network team.