A workstation in the finance VLAN trips a Snort rule and the SOC wants its network access reduced within seconds. The team already runs Cisco ISE with authorization profiles for restricted access, and this workstation authenticates through 802.1X and MAB. Which Rapid Threat Containment action should the Management Center take to restrict the endpoint?
Select an answer to reveal the explanation.
Short Explanation
Because ISE manages the workstation's access session, Rapid Threat Containment can request an ANC quarantine action; ISE then uses a change of authorization to apply the configured restriction. The firewall spots the bad traffic and ISE helps restrict access — like a bouncer trading your full-access wristband for a visitor pass.
Full Explanation
Rapid Threat Containment can use the Management Center's ISE integration to request an Adaptive Network Control (ANC) quarantine action when an intrusion event matches. ISE applies the configured ANC policy and sends a change of authorization to the access device, which updates the endpoint's network access. The precise effect depends on the ISE and access-device configuration; the change of authorization does not itself guarantee that an arbitrary authorization profile will be applied or that the restriction follows a user after an address change. A block traffic rule can stop packets at the firewall, but it is not the ISE containment action asked for here. Isolating a host with an endpoint security agent is a separate containment technique, not the Management Center's ISE-based action. Waiting for the access device's reauthentication timer would not meet the requirement for a rapid response. The integration and ANC policy must be configured, and ISE must have a session it can act on. For a safe test, check the Management Center-to-ISE connection and verify the ANC action and change of authorization in ISE.