A retail chain with 400 stores must roll out wired 802.1X without risking register outages. During the first two weeks every connected device, including unmanaged barcode scanners, must keep passing traffic while ISE records which endpoints fail authentication. Which switch port authorization mode should be enabled for this assessment phase?

Monitor mode is the right assessment setting because it allows connected devices to continue forwarding traffic while 802.1X authentication is attempted and ISE records failures. That preserves service for registers and unmanaged scanners during the two-week observation period, while giving the team endpoint-level evidence to guide enforcement later. Low-impact mode is a commonly used transition approach, but its authorization ACL limits unauthenticated traffic; even if it permits the business flows needed by registers and scanners, it cannot guarantee that every connected device continues passing all traffic. Closed mode with MAB exceptions and a quarantine VLAN is also a practical access-control design, but devices that are neither recognized nor successfully authenticated are restricted, contrary to the requirement that every device keep passing traffic. A limited-store monitor-mode pilot is a sensible way to reduce deployment risk, but it does not assess endpoints across the full 400-store chain during the specified phase. Exam caveat: monitor mode is a Cisco term; other platforms may describe the comparable behavior as open authentication or an authentication-monitoring mode, so verify the vendor’s semantics rather than relying on the label. Practical check: test an unmanaged scanner and a register on representative ports, confirm both can pass their normal traffic, and verify that a deliberately failing authentication appears in the intended ISE logs.