A traffic department adds IP cameras that the profiler classifies with a custom profile named IP Camera. The cameras share one Field Devices identity group with sensors and lights, so that single group covers all three kinds of hardware, and a hardware swap should leave the rule untouched. The rule therefore has to read the profiler's dictionary value on every session. Which authorization condition design meets the dictionary-driven requirement?
Select an answer to reveal the explanation.
Short Explanation
Conditions can read live values from a dictionary, and the profiler already fills in the endpoint policy for you. Since that value is evaluated for every session, you've got nothing to update when a camera is swapped.
Full Explanation
Authorization conditions are built from dictionary attributes, and the profiler writes its result into one of them: the endpoint policy attribute holds the profile name ISE assigned to that endpoint, and it is evaluated for each session. A condition reading endpoint policy equals IP Camera therefore keeps matching as long as the profiler classifies the hardware that way, and a swapped camera needs no list edit because the value is available from the endpoint record. The custom endpoint identity group is a manual inventory, so somebody must add and remove MAC addresses and the group can drift out of date. The Field Devices identity group cannot discriminate here, since it also holds sensors and lights and would pull them into the camera result. The MAB authentication result matches the method rather than the device class, so every MAC-authenticated endpoint matching that rule would receive camera access simply because it authenticated with MAB. Exam caveat: profiling results can change when new evidence shifts the certainty score, so confirm the profile is stable before you rely on it. Practical check: open a live session in ISE and inspect the endpoint attributes to see the profile name the rule will match.