A retail chain standardizing policy across 400 stores needs one shared rule that matches contractors in the Contractors identity group connecting from a device in the West region, and the same match must stay reusable in several policy sets. Which ISE element should hold that combined condition?
Select an answer to reveal the explanation.
Short Explanation
Conditions are where dictionary attributes meet policy, and ISE lets you build one and point several rules at it. A compound condition keeps the contractor group test and the West region test glued together, so you edit a single element instead of a stack of copies. That single source of truth is what keeps 400 stores consistent.
Full Explanation
ISE conditions are reusable policy elements built from attributes exposed by dictionaries such as Identity Group and Network Device, and they support AND logic, so one condition can hold both the contractor membership test and the West region device test and then be referenced by rules in several policy sets. Creating it under Policy Elements gives you one place to edit when a region or a group is renamed, and every rule pointing at it updates at once. Storing the combined match in an authorization profile fails that requirement because a profile defines the result the device applies, such as a SGT, dACL, or VLAN, and it does not perform matching itself. Splitting the logic into two rules on the claim that a condition holds only one dictionary attribute fails because conditions can accept attributes from multiple dictionaries, and two separate first-match rules will not enforce the AND the design needs. Keeping only the identity group in the shared rule and adding a device rule per region fails because it abandons the single reusable combined condition the design calls for. Exam caveat: a condition typed inline inside a rule is not reusable elsewhere, so only library conditions are shared across policy sets. Practical check: open the condition under Policy Elements, confirm both dictionary attributes and the AND operator, then search the rules that reference it by name.