A retail chain runs BYOD on Cisco 9200 switches in the stockroom and a 9800 controller on the sales floor, both redirecting to ISE. Onboarding needs the portal reached over HTTPS, names resolved first, and everything else blocked before registration. Which redirect ACL design satisfies those three requirements on both platforms?

The design that permits only HTTPS to ISE and DNS to the corporate resolvers, applied as the switch redirect ACL and the WLAN pre-auth ACL, allows the traffic needed to reach onboarding by name while blocking everything else before registration. Applying the corresponding ACL at both enforcement points addresses the Cisco 9200 switches and the 9800 controller. Permitting NTP as well as HTTPS and DNS may help with accurate logs and certificate validation, but it allows traffic beyond the two stated exceptions and therefore does not meet the requirement to block everything else. Using the switch redirect ACL while relying on the controller’s guest policy does not specify a WLAN pre-auth ACL; a standard guest policy can be a normal deployment pattern, but it does not ensure the required restrictions on both platforms. Permitting HTTP to the ISE portal instead of HTTPS fails the requirement for a secure portal connection, even though it includes DNS and covers both ACLs. Exam caveat: redirect ACLs and pre-auth ACLs are platform-specific enforcement mechanisms, so similar intent does not guarantee identical syntax or behavior. Practical check: test a new, unregistered client on each platform; confirm DNS resolution and HTTPS access to ISE work, while an unrelated destination and an HTTP portal request are denied.