An engineer is building an authorization rule for the ACME.COM domain and needs every PSN to return the same Active Directory group names. Users authenticate with PEAP-MSCHAPv2 and EAP-TLS, and membership changes as staff move teams. Which ISE configuration makes those AD group strings available to every PSN?
Select an answer to reveal the explanation.
Short Explanation
The domain join gives each ISE node the membership that PEAP-MSCHAPv2 and EAP-TLS authenticate against, which an LDAP service bind can't provide. Then you pull in the security groups by name so every PSN returns the same string to the rule. Local groups look fine until someone moves teams and the match stops lining up.
Full Explanation
Joining every ISE node to ACME.COM lets each PSN query the same Active Directory domain and resolve the configured groups by name or filter. Adding those groups to the identity source makes their names available consistently for authorization, while directory-backed membership reflects staff moves without maintaining a separate mapping on each node. An LDAP identity source can be a reasonable choice for directory searches and some authentication flows, but LDAP does not provide the MSCHAPv2 password-validation capability needed for PEAP-MSCHAPv2 in this setup; therefore it cannot supply the required group-based authorization across both stated methods. Periodically importing memberships into local ISE identity groups can support authorization when a directory is unavailable, but the imported memberships are snapshots: changes between imports are not reflected promptly, contrary to the requirement that membership changes follow team moves. Certificate-based authorization is common for EAP-TLS, and a certificate can carry a group-related claim, but that claim is not the live AD group string resolved from the directory; using it for EAP-TLS leaves the required common directory-derived values unavailable for that method. Exam caveat: distinguish an AD group’s name from a user’s membership in that group—configuring a group in an identity source does not itself determine the full authorization policy. Practical check: test representative users on each PSN with both EAP methods, then verify the resolved group names and updated membership after a test user changes groups.