A branch office runs central web authentication on its wireless controller: the controller redirects the guest's HTTP request to the ISE hotspot portal, the guest signs the acceptable-use policy, and only then may the guest use the internet-only VLAN behind a restricted ACL. After the portal page closes, the controller still holds the pre-authentication authorization state. Which control applies the new guest VLAN and ACL to that live session?
Select an answer to reveal the explanation.
Short Explanation
In central web auth no fresh RADIUS request arrives after the portal closes, so ISE has to push the update itself — you don't get a second chance from the device. The CoA works like a referee stopping play to reposition the teams, letting the controller rewrite the live session on the spot.
Full Explanation
In central web authentication the endpoint's first Access-Request is only answered with a challenge that opens the portal, so when the guest accepts the policy the controller still holds the pre-authentication authorization state from that first exchange. The guest's browser session is separate from the supplicant's RADIUS session, so nothing triggers a fresh Access-Request carrying the new result; instead ISE identifies the live session with the audit session ID it recorded at login and pushes a RADIUS Change of Authorization back to the controller, which re-evaluates the session and applies the attributes of its new authorization profile. Re-authentication started by the device fails because closing a browser page generates no RADIUS traffic, so that replayed request never happens. Publishing the login through pxGrid fails because pxGrid distributes session and posture data to subscribing services instead of writing attributes onto a device's live session. A post-authentication redirect address fails because it only returns the guest to the page originally requested and cannot change the VLAN or ACL already applied. Exam caveat: some controllers also hold a redirect ACL internally, but the control the exam wants is the CoA. Practical check: watch ISE's live RADIUS logs for that session, confirm a CoA was sent, then see the session move to the guest VLAN.