A hospital hands identical access ports to desk phones and to desk PCs, and the security team needs BYOD laptops moved into quarantine VLAN 210 when their identity group changes and authorization is reevaluated. No remediation portal is deployed and no per-application filtering is required. Which authorization result should the authorization profile return to enforce that isolation?
Select an answer to reveal the explanation.
Short Explanation
You're picking the result that changes where the session lives, not just what it can reach. Moving a device is like a bouncer relocating someone to another room instead of watching them in the current one, and the VLAN result is what moves the session.
Full Explanation
The authorization profile is the bundle of results ISE returns once a session is permitted, and a VLAN result can assign the session to a different VLAN. When the network access device receives the VLAN attributes and supports dynamic VLAN assignment, it assigns the session to that VLAN, where the laptop can use the quarantine DHCP scope and routing if those are configured. Because the policy matches the identity group, the result applies when authorization is reevaluated after that group changes. A downloadable ACL filters packets on the session's existing VLAN; it does not relocate the endpoint into a different Layer 2 segment. A scalable group tag gives TrustSec group-based enforcement at the edge, yet the session remains on its current VLAN. A redirect ACL can steer web traffic to a configured portal, and the scenario has no remediation portal. Practical check: open the live RADIUS session, confirm the VLAN attributes in the response, then verify the assigned VLAN on the switch.