A pharmacy chain runs 150 Windows point-of-sale terminals that already have the ISE posture agent installed. Before each terminal reaches the payment systems, three checks must all pass: the vendor agent file exists, anti-malware is current, and the required hotfix is installed. Which posture construct delivers that single all-or-nothing compliance decision?

The correct approach is to place the vendor-agent file check, anti-malware currency check, and required-hotfix check in one compound posture condition using AND logic. A compound condition combines individual posture checks into a single requirement, and AND means the requirement passes only when every check passes; ISE can then use the resulting posture status in authorization to grant or restrict access to payment systems. Adding the checks to a RADIUS authorization policy confuses access-decision logic with posture assessment: authorization can act on the posture result, but it does not itself inspect endpoint files or determine whether anti-malware or hotfixes are current. Creating a separate posture policy for each check does not express the requested single all-or-nothing requirement as directly as one compound condition with explicit AND logic. Client provisioning is also the wrong approach because it delivers software, including the posture agent, rather than evaluating the three compliance checks. Exam caveat: compound posture conditions can use AND or OR, so the operator must match the requirement; OR would allow a pass when only one check succeeds. Practical check: test an endpoint with all three items present and then remove or invalidate each item in turn, confirming it is compliant only when all three checks pass.