A payroll server must be reachable only by members of the Finance Active Directory group. The site has 400 domain-joined laptops, runs without any ISE deployment, and holds a strict policy that authentication prompts and added connection delay are unacceptable for these users. The Management Center runs release 7.6 or later with Snort 3 on its devices. Which identity policy configuration supplies the user-to-IP mapping the access rule needs?

The configuration separates group authorization from identity acquisition: the AD realm lets Firepower resolve Finance membership, while the Passive Identity Agent passively supplies user-to-IP mappings from the Active Directory environment, without requiring ISE. This supports a user-aware access rule without asking laptop users to authenticate again or inserting an authentication exchange into their traffic. Kerberos single sign-on can identify domain users without a visible prompt, but it still performs an authentication exchange when identity is needed and can add connection delay. 802.1X with RADIUS accounting and AD group authorization is a common identity-aware access design, and its records can inform downstream policy, but endpoint authentication during network access can delay setup, which this site forbids. Certificate-based authentication can identify an employee without a password prompt and support AD-backed authorization, but Firepower must perform certificate authentication and validation to establish that identity, so it does not meet the no-added-delay requirement. Exam caveat: passive mapping avoids an interactive exchange, but it is not instantaneous and can become stale if logoff or address-change events are missed. Practical check: confirm that the Passive Identity Agent can reach the domain controllers, resolve Finance membership, and report current laptop user-to-IP mappings in Firepower before testing the payroll rule.