A company runs ISE with Secure Client deployed on every laptop. When a laptop fails the antivirus version check, security wants it restricted without bouncing the switch port, and returned to full access after reassessment passes. Which posture flow meets both requirements?
Select an answer to reveal the explanation.
Short Explanation
ISE can update your laptop’s access on the fly with CoA, like changing lanes without stopping traffic: it applies restricted access after a failed check and full access after a passing reassessment. A scheduled reauthentication delays the change, and profiling doesn’t check whether your antivirus is current.
Full Explanation
The required flow uses ISE Change of Authorization (CoA) to update the active session’s authorization after the antivirus check fails, then to restore the full-access result when a later reassessment passes. CoA changes the session policy without bouncing the switch port, satisfying both the restriction and recovery requirements. Assigning separate restricted and full-access VLANs is a valid segmentation design, but the proposed implementation explicitly bounces the port to apply each VLAN change, contrary to the no-bounce requirement. A downloadable ACL is also a standard way to restrict an authenticated session without changing VLANs; however, waiting until the next scheduled reauthentication to apply or remove it does not tie the authorization changes to the failure and passing reassessment as required. Device profiling can support policy assignment, but a profile indicating a compliant device is not evidence that the antivirus-version reassessment passed; it could restore access without verifying the stated posture condition. Exam caveat: CoA behavior depends on the network access device, supported CoA type, and ISE policy configuration, so do not assume every authorization change takes effect without a session interruption. Practical check: verify in ISE live logs that failure triggers the restricted result and a successful reassessment triggers the full-access result through CoA, then confirm the switch session remains up throughout.