A county hospital builds one policy set for wired access. Clinicians must be offered only certificate-based EAP-TLS, MAB infusion pumps must be admitted with MAB alone, pumps must reach the restricted rule even though a broader clinician rule matches their session first, and every other endpoint must be denied. Which policy design meets all of these requirements?

The design that meets the requirements keeps clinician authentication EAP-TLS-only and infusion-pump authentication MAB-only, places the pump-specific restricted authorization rule above the broader clinician rule, and denies unmatched endpoints. Authorization rules are evaluated in order, so the pump rule takes effect even when a pump also matches the broader clinician rule. MAB fallback for clinicians violates the requirement to offer them only certificate-based EAP-TLS. Putting the broader clinician rule before the pump-specific rule can cause a pump matching both to receive the clinician rule’s outcome instead of the restricted pump rule. Assigning unmatched endpoints to a quarantine VLAN still grants them network access, rather than denying every endpoint outside the intended policies. Exam caveat: rule-order behavior and the distinction between authentication and authorization policies vary by platform, so interpret “first match” according to the system’s documented processing model. Practical check: test a clinician, a pump matching both authorization conditions, and an unrecognized endpoint; verify each offered authentication method, matched rule, and resulting access.