A warehouse deploys handheld scanners on access ports configured for MAC Authentication Bypass (MAB). Each scanner must land in VLAN 214 automatically, get a downloadable ACL limiting it to the warehouse management servers, carry SGT 27 for TrustSec enforcement, and start working with zero user interaction. Which authorization profile result set satisfies the warehouse access requirements?
Select an answer to reveal the explanation.
Short Explanation
You can bundle several results into one authorization profile, and this port needs the VLAN, downloadable ACL, and SGT together. Add a redirect and you've sent the scanner to a portal, which the warehouse ruled out.
Full Explanation
An authorization profile is the bundle of results ISE returns after a session authenticates, and RADIUS lets several of them travel together: a VLAN ID, a downloadable ACL name, and an SGT assignment. The warehouse rules call for all three, so one profile returning VLAN 214 plus the warehouse dACL plus SGT 27 satisfies the port requirement in a single result, with nothing that would send the scanner to a portal. The static ACL approach does not satisfy the requirement for a downloadable ACL. The native VLAN approach fails the addressing requirement, since leaving the scanner on its current data VLAN puts it outside VLAN 214 and its routing. The redirect approach breaks the promise of portal-free access, because a URL-redirect ACL redirects matching HTTP traffic to the configured portal. Exam caveat: the switch must be TrustSec-capable and defined in ISE as a network device with SGT enabled before the tag does anything useful. Practical check: run a live authorization test from ISE and inspect the returned attributes to see the VLAN, dACL name, and SGT together.