A county government issues 400 Windows 11 laptops that are joined to the domain, and its 60 iPads must reach the same wireless network with no software installed. ISE should deliver the posture module to the laptops automatically on their first connection, and it offers the module through a provisioning step after the Access-Accept. Which factor decides which agent package an endpoint is offered?
Select an answer to reveal the explanation.
Short Explanation
ISE picks the package before posture assessment ever runs, and that choice lives in the client provisioning policy. Your endpoint's operating system works like a size tag telling the shelf which box to send, while the directory group narrows it to the right people. That's why the iPads stay untouched.
Full Explanation
The correct choice is the client provisioning policy: ISE uses the policy rule that matches the endpoint's operating system and the configured identity conditions, such as a directory group, to decide which agent package to offer, and the authorization profile applies that result by redirecting the session to client provisioning after Access-Accept. The posture-policy alternative reverses the order of events: posture requirements are evaluated by the agent that provisioning installs, so a compliance result cannot decide which package is delivered in the first place. The portal alternative can target packages by OS and directory group, but it depends on a user opening a portal rather than ISE automatically offering the module in the post-Access-Accept provisioning step. The authorization-profile alternative keeps the right policy conditions, but a profile that only assigns access and does not invoke provisioning will not deliver the package; matching a policy alone does not cause installation. Exam caveat: distinguish the policy that selects a package from the authorization profile that applies the provisioning action; both are relevant, but they perform different jobs. Practical check: inspect the matched client provisioning policy and the authorization profile in the live RADIUS session details, then confirm the laptop receives the expected module on its first connection.