During a campus rollout you must touch every access port this weekend. IP phones and legacy printers must retain the network access they need while they authenticate, unauthorized clients must be restricted before authorization instead of given the full LAN, and the audit needs start and stop session records in ISE rather than only in the switch log. Which IBNS port mode and logging choice meets all three requirements?
Select an answer to reveal the explanation.
Short Explanation
Choose low-impact mode with a pre-authentication ACL that lets IP phones and legacy printers reach only the services they need while they authenticate—like a guest pass that opens just the right doors. Add session accounting to ISE so your audit captures both start and stop records.
Full Explanation
Low-impact mode uses a pre-authentication ACL to control what an unauthenticated device can reach; the ACL must permit the traffic needed for the deployment's onboarding requirements and deny access to protected resources. With session accounting configured, the switch sends RADIUS accounting start and stop records to ISE. Monitor mode does not enforce pre-authorization access restrictions, so it does not meet the requirement to restrict unauthorized clients. Closed mode blocks ordinary access until authorization succeeds, so it does not meet the requirement to retain needed access while devices authenticate. Writing results only to the switch log does not provide ISE with the requested accounting records. Exam caveat: open, closed, low-impact and monitor modes differ in how access is handled before authorization. Practical check: test an unmanaged printer against the intended pre-authentication ACL, then verify that ISE receives accounting start and stop records.