A hospital requires posture checks for clinicians on the corporate WLAN. A doctor's laptop joins the SSID before anyone installs Cisco Secure Client, so the authorization rule returns a URL redirect to the client provisioning portal. The laptop installs the posture module and reports compliant, yet its session still holds the limited role from the first authentication, and clinicians need full access the moment compliance is reported. Which step completes the posture flow at this point?
Select an answer to reveal the explanation.
Short Explanation
You keep the limited role until ISE forces a fresh exchange, and that nudge is the CoA. The controller re-authenticates the laptop, and this time authorization sees the compliant result — it's the badge reader re-scanning you the moment your access level changes.
Full Explanation
Posture is enforced at authorization time, so nothing changes while the original session stays alive. When the endpoint finishes installing the posture module and reports compliant, ISE re-evaluates the posture condition and sends a RADIUS Change of Authorization to the wireless controller, which reauthenticates the session. That new request carries the compliant posture result, so the authorization rule now matches the full-access profile instead of the limited role, giving the clinician back access immediately rather than later. Waiting for the scheduled reauthentication timer keeps the doctor on restricted access long after compliance is reported, expecting the controller to start the refresh on its own ignores that ISE must initiate the change, and pushing an access role straight to the Secure Client misplaces enforcement because the controller and the switch decide what the endpoint may do. Exam caveat: the redirect can come from a client provisioning portal or from a URL-redirect authorization profile, and both paths still finish with a CoA. Practical check: watch the live session view and confirm a CoA record appears right after the endpoint reports compliant.