A hospital runs ISE in a distributed deployment with two Policy Service nodes. Every switch, WLAN controller and VPN gateway lists only PSN-1 as its RADIUS server, and a maintenance window requires taking PSN-1 offline for patching. The design must run with no extra appliance between the network devices and ISE. Which high-availability change for the Policy Service nodes keeps authentication available?
Select an answer to reveal the explanation.
Short Explanation
Your devices only reach the AAA servers typed into their own config, so the spare entry has to live there too. When PSN-1 doesn't answer, the device tries that second entry and PSN-2 handles the request. It's plain RADIUS failover, and you set it up on the switch rather than in ISE.
Full Explanation
The correct change is to configure PSN-2 as the backup RADIUS server on every switch, controller and VPN gateway. When PSN-1 is unavailable, each device can fail over directly to the other Policy Service node, with no intermediary appliance. Local authentication is a common contingency for network-device access, but it does not preserve authentication through ISE; it bypasses ISE’s centrally applied identity and policy decisions. Enabling the PSN-2 backup only after PSN-1 is offline leaves a gap at the start of the maintenance window, when devices still have no usable server configured. A shared DNS name that resolves only to PSN-1 does not provide a second RADIUS destination, so name resolution cannot direct requests to PSN-2 when PSN-1 is down. Exam caveat: listing a backup server is not enough if device-specific RADIUS settings, shared secrets, or failover timers prevent successful use of that server. Before patching, verify that every device class has PSN-2 configured and test authentication through it while PSN-1 is unavailable.