At a manufacturing plant, contractors plug into the PlantGuest guest ports and must type a username at a captive portal before user traffic flows. The switch must steer the unauthenticated session toward ISE's portal, and after a successful login the live session must be re-evaluated by the guest authorization policy. Which mechanism completes this central web authentication flow?

The correct mechanism combines a redirect ACL with a post-login RADIUS Change of Authorization (CoA): the ACL steers unauthenticated browser traffic to ISE’s portal, and CoA prompts the switch to re-evaluate authorization on the existing session after successful login. A CoA disconnect instead terminates the session; reconnecting may obtain the guest policy, but it does not re-evaluate the live session in place. A switch-hosted captive page with RADIUS authentication uses the switch rather than ISE to host the portal, so it does not meet the requirement to steer the browser to ISE. Redirecting to ISE and relying on periodic reauthentication may eventually retrieve the guest policy, but it does not trigger immediate re-evaluation after login. Exam caveat: deployments may use different names or variants for CoA, such as RADIUS reauthorization, so distinguish the session action from its label. Practical check: verify that the unauthenticated session receives the redirect ACL and that a successful portal login produces a CoA reauthorization visible in ISE and the switch session details, applying the guest policy without waiting for the timer.