A university is splitting ISE across two VMs. The first VM already runs the admin GUI, the policy configuration and the monitoring database, and the team wants policy edited from that one node only. At peak, 15,000 endpoints hit RADIUS, MAB and captive-portal authentication at once, while a SIEM consumes the monitoring feed. Which ISE persona should run on the second VM to carry that authentication load?
Select an answer to reveal the explanation.
Short Explanation
Put a Policy Service node on VM two so it can handle your peak RADIUS, MAB, and portal authentication load. It’s like adding another checkout lane; the Monitoring node feeds your SIEM, while policy editing stays on the primary admin node.
Full Explanation
The Policy Service node is the persona that handles network access requests, so placing it on the second VM can move authentication load off the first one while the GUI, policy configuration and monitoring database stay there. A Monitoring node collects, correlates and serves log data for troubleshooting; it does not terminate authentication traffic. The pxGrid service publishes and consumes context such as session and posture data for other products, but does not itself add authentication capacity. A deployment can have a secondary administration node, but it is not an additional active policy editor: while the primary administration node is active, the secondary is read-only. Exam caveat: a node commonly runs several personas at once, and the Policy Administration Node often also runs the Policy Service persona, so the question asks which persona carries authentication. Practical check: watch the authentication queue during the morning peak and confirm requests are being served by the new VM.