A hospital's single ISE appliance serves several thousand endpoints, and the shift-change login surge already pushes it near capacity. Security wants one place where administrators author policy, plus the ability to add authentication capacity in stages without rewriting policy. Which ISE deployment design meets all of these requirements?
Select an answer to reveal the explanation.
Short Explanation
You can add authentication capacity in stages by adding policy service nodes, while one primary admin node remains the place where administrators author policy. That’s like opening more checkout lanes while one manager keeps writing the rules.
Full Explanation
A distributed ISE deployment with one primary administration node and multiple policy service nodes (PSNs) meets both requirements: administrators author policy centrally, while PSNs handle authentication and can be added incrementally as endpoint load grows. A single centrally administered appliance keeps policy administration in one place, but replacing it with a higher-capacity model is vertical scaling, not staged addition of authentication capacity. Separate deployments for each site can grow by adding PSNs, but each has its own administrator and policy store, so administrators do not have one place to author policy across the sites. A distributed system with one primary admin node and PSNs provides centralized administration, but replacing existing PSNs with larger appliances does not add capacity in stages; it increases capacity through upgrades rather than scale-out. Exam caveat: the primary admin node is a control-plane role, not an authentication worker, so it does not handle the login surge. Practical check: confirm that proposed PSNs are registered in the same ISE deployment, included in the authentication flow’s load balancing, and sized for the expected shift-change peak.