A regional bank runs a single authentication policy rule backed by an identity source sequence: employees live in Active Directory, auditors in a separate LDAP directory, and a break-glass account sits in the ISE internal user database. Identical service usernames exist in both directories and must resolve to Active Directory. Which sequence order meets all of the bank's login requirements?
Select an answer to reveal the explanation.
Short Explanation
Your identity source sequence works like a line: put Active Directory first so duplicate usernames resolve there, then LDAP for auditors, and the internal user store last for the break-glass account. If a user isn’t found in an earlier store, the next one gets checked.
Full Explanation
The correct sequence places Active Directory before LDAP and the internal user store last. That order includes every required identity source while ensuring that a username present in both directories is resolved against Active Directory first; it also preserves LDAP for auditors and the internal database for the break-glass account. Putting LDAP first is a conventional way to prioritize an LDAP population, but it fails the explicit precedence requirement: a duplicate service username can resolve to LDAP rather than Active Directory. Routing break-glass logins through a separate rule can be a valid design when policies are intentionally divided by identity or context, but it fails this scenario’s requirement to use a single authentication policy rule backed by the specified source sequence. Treating an Active Directory rejection as “user not found” is a common fallback behavior in some identity-source configurations, yet it undermines the required directory precedence: a failed AD authentication can continue to LDAP and accept the duplicate account there. Exam caveat: source order alone does not guarantee precedence if the product is configured to continue after a rejection, so distinguish “user not found” handling from invalid-credential handling. Practical check: test the same service username with credentials valid only in each directory, then verify the authentication logs identify Active Directory as the source whenever that username exists there.