A university is enabling 802.1X on access switches serving lecture-hall labs full of printers, badge readers, and unmanaged instruments. For a four-week assessment, no port may lose existing connectivity even when authentication fails or no client answers, yet ISE must log the identity and result of every connection. Which IBNS mode fits the assessment phase?

Monitor mode fits an assessment that must preserve existing connectivity while giving ISE visibility into authentication outcomes. The switch runs both 802.1X and MAC Authentication Bypass (MAB), reports the results to ISE, and allows access regardless of whether authentication succeeds or a client responds. This lets you assess coverage and failures without disrupting printers, badge readers, or instruments. Low-impact mode is a staged-deployment approach, but its pre-authentication access is limited to selected services; endpoints may lose access to other resources they currently use. Closed mode with MAB fallback supports both responsive and silent endpoints when they can authenticate, but denies access if authentication fails or neither method gets a usable response, violating the requirement to preserve connectivity. Open mode with 802.1X keeps forwarding available despite authentication outcomes, but it does not use MAB to account for silent devices that never answer EAPOL. Exam caveat: “open” and “monitor” are not interchangeable labels across all switch platforms and IBNS generations, so verify the configured behavior rather than relying on the mode name. Practical check: test an 802.1X-responsive endpoint, a MAB-only device, and a silent or failing endpoint; confirm uninterrupted access and the expected ISE session records for each connection.