A regional bank authenticates temporary paralegal laptops with 802.1X on its wired ports. Policy requires these sessions to land in quarantine VLAN 250, reach only DHCP, DNS and the WSUS server, and continue straight through with no portal step. The access switches are older models without SGT or TrustSec enforcement. Which authorization profile should the contractor authorization rule return?
Select an answer to reveal the explanation.
Short Explanation
Because your access switches cannot enforce SGT or TrustSec policy, your authorization needs to use the VLAN and downloadable ACL. Return VLAN 250 with a downloadable ACL that permits only DHCP, DNS, and WSUS, so your contractors get the required access without a portal step.
Full Explanation
The correct authorization profile returns VLAN 250 with a downloadable ACL (dACL) permitting only DHCP, DNS, and the WSUS server. This places the session in the required quarantine VLAN and enforces the stated access limits on switches that cannot apply SGT or TrustSec policy; it also lets contractors continue without a portal step. Permitting NTP in addition to DHCP, DNS, and WSUS may help endpoints maintain accurate time, but it grants access beyond the explicit allowlist. Requiring fresh 802.1X reauthentication before applying the exact VLAN and ACL adds an intervening authentication step, contrary to the requirement to continue straight through. Assigning VLAN 251 with an ACL limited to DHCP, DNS, and WSUS preserves the traffic restriction but fails the required VLAN 250 assignment; a remediation VLAN does not substitute for the specified quarantine VLAN. Exam caveat: a dACL controls permitted traffic, while VLAN assignment determines Layer 2 placement, so meeting one requirement does not make up for missing the other. Practical check: verify the authorization result on the switch, confirm VLAN 250 and the applied ACL, and test that only DHCP, DNS, and WSUS are reachable without a portal or reauthentication prompt.