A manufacturer is rolling ISE out to three regions. Policy must be edited from one console, logins must keep working when a region's WAN link to the data center drops while local identity services remain reachable, the incident-response team needs heavy live-session searches that leave configuration and policy decisions unaffected, and the next-generation firewall wants live endpoint context. Which ISE persona design meets all four requirements?
Select an answer to reveal the explanation.
Short Explanation
You can use a PAN for policy edits, regional PSNs for logins during a WAN outage, a separate MN for heavy live-session searches, and pxGrid to share live endpoint context with the firewall. Giving each job its own role helps keep one team’s workload from affecting the others.
Full Explanation
The design that assigns configuration to a PAN, logins to regional PSNs, heavy live-session searches to a separate MN, and firewall context sharing to pxGrid meets all four requirements. The Policy Administration Node lets administrators manage policy from one console. Regional Policy Service Nodes handle authentication and authorization requests locally, so logins can continue during a data-center WAN outage when local identity services remain reachable. A separate Monitoring node serves live-session and historical monitoring data, helping heavy searches avoid competing with configuration work or policy evaluation. pxGrid shares endpoint and session context with consumers such as a next-generation firewall. Using one PAN for both configuration and live monitoring searches lacks the separate MN needed to isolate the heavy search workload. Sending every region’s logins to data-center PSNs makes authentication dependent on the WAN, even if a separate MN and pxGrid are used. Using a PAN, regional PSNs, and a separate MN addresses configuration, login availability, and searches, but without pxGrid the firewall lacks the ISE context integration it needs. Exam caveat: ISE deployments can combine personas on nodes; separating them here addresses the stated workload and availability requirements. Practical check: in the ISE deployment settings, confirm that the assigned personas match the intended roles.