An insurance company adds a second ISE VM to carry RADIUS traffic for a new campus building and to keep AAA running while the first node is offline for maintenance. The first node is already the primary Administration node, the primary Monitoring node, and a Policy Service Node. Which persona assignment on the second node completes this design?

Personas are assigned to a node that has already joined a deployment, and each persona has one job: the Policy Service Node terminates RADIUS and runs the authorization pipeline, so a second one adds AAA capacity in the new building and keeps authentication available while the first node is under maintenance. The Administration persona is not a scaling answer for AAA, because it owns the configuration database and publishes it to the rest of the deployment instead of authenticating users, so a standby administrator earns you no extra RADIUS capacity. The second node cannot also become the primary Monitoring node while the first node holds that designation; although a node with both Monitoring and Policy Service personas can serve logins, this proposed assignment conflicts with the existing primary Monitoring role. A separate deployment keeps its own policy store, identity sources and authorization results, so it does not share configuration with your existing network or provide failover for it. Exam caveat: one node may carry several personas at once, so a VM acting as both Policy Service and Monitoring is legal, but a second primary Administration or Monitoring node never is. Practical check: after joining, confirm the node appears under Deployment with only the intended persona enabled, then watch Live Logs for requests arriving from the new building.