A company runs 802.1X access with Cisco ISE, and a managed laptop in an open-plan office has just tripped an intrusion rule the security team judges as a real compromise. They want automatic containment at the access layer so the laptop loses useful network reach even if the user unplugs it and moves it to another desk jack, with a clean way to reverse the action later. Which Rapid Threat Containment response should the FMC issue?

The ISE pxGrid quarantine remediation is the right response because it lets the correlation rule automatically request endpoint containment from ISE, which can enforce restricted access at the network access layer. Since ISE applies the restriction to the endpoint rather than only to one physical jack, the control can remain effective when the laptop reconnects at another desk; ISE also provides a managed way to remove the quarantine later. A host-specific block deployed to FTDs can stop the laptop’s traffic and an expiration can make reversal straightforward, but it enforces the block at the firewall, not at the access layer as required. Requiring analyst approval for ISE ANC quarantine uses the appropriate access-layer mechanism and can be reversed, but it is not automatic containment. Shutting down the current switch port is automated and readily reversible, but it contains a location, not the endpoint: reconnecting the laptop to a different jack leaves it able to obtain network access there. Exam caveat: an ISE quarantine is effective only if the pxGrid integration, endpoint identity mapping, and authorization policy are configured to apply the intended restricted access; merely generating a quarantine request does not guarantee enforcement. Practical check: test a quarantined managed endpoint by moving it to another enabled access port, confirm that ISE still assigns the restricted authorization, and then verify that clearing the quarantine restores normal access.