A manufacturer is moving 8,000 domain-joined laptops onto 802.1X, and every VLAN and dACL decision depends on Active Directory security groups. Thirty shared kiosk accounts are not in Active Directory and are used only on the lobby machines, while field contractors must present a one-time passcode from the existing RSA SecurID server during RADIUS login. Which identity store design covers all three groups correctly?
Select an answer to reveal the explanation.
Short Explanation
You're matching each group to the store that can actually answer for it. Active Directory knows the security groups behind those VLAN decisions, the internal user store covers accounts that were never created in a directory, and RSA SecurID is where the passcode gets checked. It's like one key ring per door, and mixing them up locks somebody out.
Full Explanation
The correct design assigns each population to an identity source that can meet its specific need: AD supplies laptop identities and security-group membership for VLAN and dACL decisions; ISE’s internal store can authenticate the shared kiosk accounts that do not exist in AD; and RSA SecurID provides the contractors’ required one-time passcodes during RADIUS authentication. Certificate-based laptop authentication is a legitimate 802.1X approach, but authorizing from certificate attributes does not satisfy the stated requirement that every VLAN and dACL decision depend on AD security groups. ISE internal kiosk accounts are appropriate for the lobby machines, but allowing those accounts on every wired access port improperly extends their use beyond the explicitly limited kiosk population and network location. Duo can provide MFA during RADIUS login, but substituting it for the existing RSA SecurID server fails the specified contractor token-source requirement, even though the login flow still uses a one-time passcode. Exam caveat: authentication and authorization are distinct; a successful certificate or password check does not prove that the policy uses the required group attributes or identity store. Practical check: validate representative laptop, kiosk, and contractor authentications in the RADIUS/ISE logs, confirming the selected identity source, AD group resolution, assigned VLAN/dACL, and the OTP request path.