You are rolling out IBNS 2.0 on hospital access switches. Medical devices must receive a per-user dACL and a dynamic SGT after 802.1X succeeds, printers that fail authentication must land in a quarantine VLAN, and the port must pass traffic only after authorization completes. Which combination satisfies all three requirements?

The correct combination meets all three requirements: closed mode prevents the port from passing traffic until authorization completes; the RADIUS authorization result supplies both the per-user dACL and dynamic SGT after successful 802.1X; and the failure action places unauthenticated printers in the quarantine VLAN. Open mode can still obtain the required RADIUS attributes and assign failed printers to quarantine, but it permits traffic before authorization, violating the required traffic gate. A statically assigned SGT can be a valid way to classify endpoints in other designs, but it does not provide the dynamic SGT required here; the per-user dACL, closed behavior, and quarantine action alone do not make up for that missing attribute. Applying a restrictive ACL to failed printers can limit access and is a common remediation technique, but it leaves them on their existing VLAN rather than placing them in the specifically required quarantine VLAN. Exam caveat: closed-mode behavior and the exact failure-action syntax can vary by platform and software release, so do not infer enforcement solely from the policy name. Practical check: test successful and failed authentications on the target switch, verify the session’s dACL and SGT in the authorization details, confirm failed printers receive the quarantine VLAN, and attempt traffic before authorization to confirm it is blocked.