A network engineer for a plant with 400 access switches is writing one authentication rule and wants to know how ISE resolves credentials when the first store cannot answer. Employees sit in Active Directory while 30 contractor accounts exist only as ISE internal users, and the sequence lists Active Directory first. How does the identity source sequence behave when the domain controller is offline?
Select an answer to reveal the explanation.
Short Explanation
ISE checks the identity stores one after another until one of them accepts the credentials, so Active Directory gets the first try and the local store catches whatever it misses. You keep one rule while contractors still clear the switch when the domain goes dark. It's like a queue that steps forward when the first window closes.
Full Explanation
An identity source sequence is an ordered list that a single authentication rule consults, and ISE walks it from top to bottom until one store accepts the credentials. With Active Directory placed first, employee lookups still land on their domain accounts, while a contractor who exists only in the ISE internal user store is picked up by that second entry the moment the domain controller stops answering, so the fallback happens inside the same rule. Requiring a separate rule per store is a real design teams use, but it contradicts the one-rule sequence already written here and forces an extra condition to split employees from contractors. Trying the internal store first is a choice some teams make on purpose, yet it reverses the configured order and would make local accounts authoritative for employees. Using Active Directory alone is the most common enterprise setup, but it leaves internal contractor accounts unreachable whenever the domain cannot answer. Exam caveat: the sequence decides authentication only, so your authorization rules still have to reference groups coming from both stores. Practical check: take a domain controller down, authenticate a contractor, then bring it back and confirm an employee still resolves to an AD group.