A financial-services SOC sees a Snort event on an FTD sensor showing malware callbacks from a Windows laptop on an 802.1X-enabled floor network. Company policy says the laptop must be cut off at the access layer within seconds, wherever it is plugged in, and the site already runs Cisco ISE with pxGrid connected to the Secure Firewall Management Center. Which Rapid Threat Containment action isolates the endpoint?
Select an answer to reveal the explanation.
Short Explanation
Because your laptop can move and get a new address, an address-based rule can go stale fast. ISE can quarantine its live session with a restrictive ANC policy—like revoking a badge wherever you go—through pxGrid.
Full Explanation
The correct action uses the existing ISE and pxGrid integration to apply a restrictive Adaptive Network Control (ANC) policy to the laptop’s active 802.1X session. ISE can then enforce quarantine through the network access layer, meeting the requirement for rapid isolation wherever the endpoint connects, rather than merely blocking selected traffic at a firewall. A switch ACL tied to the current port can quickly restrict access, but the restriction is localized to that port; if the laptop reconnects elsewhere, the policy may not follow its identity. EDR network containment is a well-established way to isolate a compromised host quickly, but it is enforced by the endpoint agent, not by the access layer as required here. An FTD rule that blocks the source IP can stop traffic traversing that firewall, but it does not remove the laptop’s network access at the switch and may not apply if its address or path changes. Exam caveat: pxGrid shares context and enables coordination; the actual quarantine depends on ISE being able to apply an ANC policy to the authenticated live session. Practical check: verify that the ISE session is present, the intended ANC policy is configured, and a test containment event changes the endpoint’s access state promptly across relevant access switches.