A warehouse deployed 60 handheld barcode scanners, but the ISE profiler places them in the Printers endpoint identity group because their DHCP fingerprint matches that template. Policy requires every scanner to land in the Handheld Devices group before authorization rules run, and the profiler must never move them afterward. Which endpoint identity management approach guarantees that group membership?
Select an answer to reveal the explanation.
Short Explanation
Statically assigning the group writes it into each scanner's endpoint record, so later profiling cannot change it. It's like nailing a name tag to a jacket instead of hanging it on a hook. Your scanners then show up in the right endpoint identity group before any rule is evaluated.
Full Explanation
ISE stores an endpoint identity group on each endpoint record, and the Static Group Assignment setting tells the profiling service to leave that group alone when it evaluates the endpoint, so the scanners keep Handheld Devices even if the profiler concludes they match another profile. Because authorization conditions can use the endpoint identity group, the scanners match the intended rule. A profiling policy ordered ahead of the printer template may place them correctly at first, but that result is dynamic and can change if the profile or matching data changes. A profile-driven identity group has the same weakness, since its membership depends on the profile matching. Matching the scanner MAC addresses in the authorization rule can steer them onto the right network, but it does not populate the endpoint identity group, so other rules keyed on that group still will not match them. Exam caveat: a bulk endpoint import can seed records with a group and the static assignment enabled. Practical check: open Context Visibility, then Endpoints, and confirm each scanner still shows Handheld Devices after a day online.