A security architect is documenting how pxGrid behaves when Secure Firewall Management Center consumes user and endpoint context from Cisco ISE. The notes must reflect that a controller coordinates topic access, that identity data originates in ISE, and that the Management Center must authenticate to the controller before it can subscribe. Which description of the pxGrid publisher and subscriber roles is accurate?
Select an answer to reveal the explanation.
Short Explanation
Think of pxGrid as a switchboard: you have ISE run the controller and publish identity context, while the Management Center authenticates, registers, and subscribes. The controller coordinates topic access, so authentication must happen before subscription.
Full Explanation
The accurate description gives each pxGrid role its proper responsibility: ISE runs the controller and publishes identity and endpoint topics, while Secure Firewall Management Center registers as an authenticated client and subscribes to them. The controller coordinates client access to topics; it does not replace ISE as the source of identity data. A description that assigns authorization of each topic request to ISE rather than the controller confuses the publisher’s role with the controller’s access-coordination role. A description that has Management Center register and subscribe before authenticating reverses the required sequence: Management Center must authenticate to the controller before subscribing. A description that substitutes polling for subscription describes a familiar API retrieval pattern, but not the pxGrid subscriber behavior in this scenario. Exam caveat: distinguish the controller’s responsibility for coordinating topic access from the publisher’s responsibility for supplying data; labels such as “broker” or “publisher” alone may not make that distinction clear. Practical check: in a deployment, verify the Management Center’s pxGrid client status and granted topic subscriptions in ISE, then confirm that context updates arrive from ISE.