A retail bank is wiring open-plan desks where each Cisco IP phone has a desktop PC on its PC port. The phone must be authorized as a device, the PC must complete its own 802.1X exchange with the employee's credentials, and the desk standard allows only one data device per port. Which IBNS 2.0 host mode satisfies all three rules for these desk ports?
Select an answer to reveal the explanation.
Short Explanation
Multi-domain authentication is the mode Cisco built for exactly this pairing: one phone and one PC, each with its own session. The sessions have separate authorization results, so a problem with one session does not automatically change the other's result. Your phone stays in the voice domain while the PC keeps its own user session.
Full Explanation
Multi-domain authentication divides one access port into a voice domain and a data domain, so the switch can run two independent authentications on the same cable: the phone receives device-based authorization in the voice domain while the PC completes its own 802.1X exchange with employee credentials in the data domain. The mode admits only one device per domain, which matches the desk standard. Multi-auth mode also separates voice and data, but it permits multiple data devices behind the phone, so it does not enforce the one-data-device rule. Multi-host mode authenticates only the first device and extends that result to other devices on the port, so the PC would not present its own credentials. Single-host mode admits one host and can allow a phone to reach the voice VLAN without a separate session, so the phone does not receive device-based authorization. Exam caveat: the phone lands in the voice domain only when the AAA response carries the voice traffic class attribute, so check that authorization profile as well. Practical check: run show authentication sessions interface and confirm two sessions with different authorization results.