A hospital has 30 infusion pumps that use MAB only, emit no DHCP or HTTP data, and do not respond to any enabled profiling probes, so profiling labels them unknown. The rule granting the medical VLAN keys on Endpoint Identity Group = Medical Devices, and access-switch ports must not change. Which endpoint identity management change places these pumps on the medical VLAN?
Select an answer to reveal the explanation.
Short Explanation
Spot on — when a device won't talk to the probes, you stop asking and just pin it yourself. It's like labelling a box by hand instead of waiting for the scanner to read it. The endpoint identity group is the key the authorization rule already looks for.
Full Explanation
The existing VLAN rule grants access based on membership in the Medical Devices endpoint identity group, so statically placing each pump in that group directly satisfies the rule’s condition. This is appropriate when profiling cannot identify the devices and the pumps use MAB; it requires no port changes or unsupported authentication method. MAC-OUI profiling is a common way to classify endpoints, but a profiler label such as “infusion device” is not itself membership in the endpoint identity group the rule evaluates. The dedicated-group approach organizes the pumps sensibly, but the existing rule recognizes only Medical Devices; adding another group to the rule changes the policy rather than making an endpoint identity change that satisfies the stated rule as-is. A centralized MAB authorization policy can assign a VLAN by MAC address, but it bypasses the group-based rule instead of making that rule match, so it does not meet the requested identity-management change. Exam caveat: endpoint profiling labels, identity-group membership, and authorization results are distinct concepts even when a product presents them in a related policy interface. Practical check: after assigning the pumps, verify that each endpoint record shows Medical Devices membership and that a test MAB session matches the intended VLAN rule.