A hospital security team sees a correlation event showing a lab workstation talking to a known command-and-control address. The workstation holds a valid 802.1X session through Cisco ISE, and policy requires it to land in a quarantine VLAN where it can still reach the patch server. The response must fire from the event itself rather than from a timer. Which Rapid Threat Containment action should the team configure?

The correct action uses Rapid Threat Containment to send an ISE Adaptive Network Control quarantine request in response to the correlation event. Because the workstation has a valid 802.1X session through ISE, ANC can change its network authorization and place that session in the required quarantine VLAN; the VLAN’s policy can preserve access to the patch server. This matches both the required containment mechanism and the requirement to act from the event itself. Applying a downloadable ACL can block the command-and-control destination while retaining patch access, but it does not move the workstation into the required quarantine VLAN. An ANC request that does move the session to that VLAN is also a plausible containment action, yet an ACL that blocks the patch server fails the stated need to keep that service reachable. Scheduling the ANC request can ultimately produce the right VLAN and access, but it makes response depend on a timer rather than firing from the correlation event. Exam caveat: ANC quarantine behavior depends on the configured ISE policy and enforcement support; the action name alone does not guarantee the intended VLAN or allowed services. Practical check: verify the event-to-ISE integration, the endpoint’s session mapping, the quarantine VLAN’s patch-server rule, and that a test event triggers the request immediately.