A 900-bed hospital must keep 40 infusion pumps matching its Medical-Devices authorization rule. The pumps roam across three floors, take addresses from several subnets, and change DHCP fingerprints after firmware updates, while the same vendor's barcode scanners share their MAC OUI. Which endpoint identity approach holds these pumps in one group?
Select an answer to reveal the explanation.
Short Explanation
A static assignment keeps each pump in its group as long as its MAC address stays the same, regardless of roaming or changes to the probes. It's like writing the name on the door instead of guessing from the badge color. You'll get stable matches around the clock.
Full Explanation
ISE lets you register an endpoint by MAC address and assign it an identity group by hand; an authorization condition can match that group. Because the group assignment is tied to the MAC address rather than to a network location or a changing probe attribute, the pumps stay in Medical-Devices while they roam between floors and while firmware changes their DHCP fingerprints, provided their MAC addresses remain the same. Subnet-based profiling policies could place an endpoint in a different group as its address changes, so they are not a reliable way to keep these pumps together. Relying on DHCP and HTTP probe attributes is also less reliable here: a firmware update that changes an attribute used by the profile can affect the resulting classification. Matching the MAC OUI fails the precision requirement because the scanners from the same maker share it, so the rule could include devices that should not receive medical-device access. Exam caveat: a static entry follows the MAC address, so a replaced network card or a randomized address needs a fresh entry. Practical check: search the endpoint in ISE by MAC, confirm the group, then move the pump to another floor and watch the authorization result in live sessions.