A retail chain uses the ISE sponsor portal so store managers can create guest accounts. Corporate requires that each sponsor can issue only their own store's guest type, that every account expires within three days, and that sponsors may manage only the accounts they created themselves. Which ISE configuration enforces all three rules for those sponsors?

The correct configuration applies the three controls at the appropriate scope: a separate sponsor group for each store limits the guest types its sponsors can issue; the group’s guest-duration setting caps account validity at three days; and the account-management scope restricts sponsors to accounts they created. These controls work together, rather than relying on a general policy that leaves a store-specific or ownership rule unenforced. A shared group that authorizes every store’s guest type can still enforce the duration cap and creator-only management, but it does not prevent a sponsor from issuing another store’s guest type. Allowing sponsors to choose an expiration up to seven days preserves the store-specific guest type and creator-only scope, but permits accounts to outlast the required three-day maximum. Allowing sponsors to manage all accounts created by members of their group preserves the guest-type and duration restrictions, but grants access to accounts created by other sponsors, not just their own. Exam caveat: exact labels and available scope choices can vary across ISE versions, so distinguish the guest-type restriction from account-management scope rather than inferring one from the other. Practical check: test with sponsors from two stores, confirming each sees only its permitted guest type, cannot set validity beyond three days, and cannot manage another sponsor’s account.