A logistics firm enables BYOD onboarding on its Cisco access ports. Any device that fails 802.1X must reach the ISE self-registration portal, resolve that portal by name over DNS, download its provisioning profile from ISE's internal CA, and remain isolated from internal application servers until onboarding completes. Which policy design meets these requirements?

The design must provide limited reachability before authentication while keeping the device isolated from internal application servers. Permit DHCP, DNS, and access to the ISE portal in the pre-authentication ACL, deny other destinations, and use the redirect ACL to exempt the required traffic while redirecting web traffic to ISE. This lets the device resolve the portal by name, reach self-registration without redirecting the portal traffic itself, and obtain its provisioning profile from ISE’s internal CA. Allowing DHCP, DNS, and portal traffic but redirecting all web requests, including requests to the portal, can interfere with portal access instead of exempting it. Permitting DHCP and direct portal access by IP without DNS fails the requirement to resolve the portal by name. Permitting DHCP, DNS, and portal HTTPS while omitting the internal CA enrollment endpoint from the allowlist can prevent the device from downloading its provisioning profile. Exam caveat: ACL direction, redirect behavior, and required ISE service ports vary by platform and deployment; allowing the portal host alone may not cover every provisioning service. Practical check: test a failed-authentication endpoint end to end, verifying DNS resolution, portal loading, profile enrollment, and blocked access to internal application servers until onboarding completes.