A retail chain is deploying ISE at headquarters and at four stores. Corporate wants one place where policies are built and changed, while each store must still evaluate its own 802.1X authentications when the link to headquarters is down. The administrator is assigning personas in the deployment wizard. Which persona layout for headquarters and store nodes fits these two requirements?

The correct layout puts Administration and Monitoring at headquarters and a Policy Service node in each store. This gives the organization one central place to create and change policy while allowing each store to evaluate 802.1X requests locally when its link to headquarters is unavailable. A standalone Administration and Policy Service deployment at every store can support local authentication, but separate Administration personas create separate policy authorities instead of the required single place for policy changes. A redundant headquarters Policy Service cluster can handle requests proxied from stores, but stores cannot evaluate authentications locally if the headquarters link fails. A store Policy Service node that queries the headquarters directory can evaluate policy locally, but the directory dependency still fails when the link is down, defeating the outage requirement. Exam caveat: a local Policy Service persona alone does not guarantee offline authentication; identity sources, certificates, authorization data, and other dependencies must also be reachable or available locally. Practical check: disconnect the headquarters link and test a representative 802.1X login at each store, confirming local authentication succeeds and policy changes remain centrally administered.