A network operator authenticates every user with PEAP-GTC through one rule: staff accounts exist only in Active Directory, partner accounts only in an LDAP server, and two break-glass admin accounts live inside ISE alone. Groups must come from the store that accepted the user. Which identity source design fits these requirements?
Select an answer to reveal the explanation.
Short Explanation
A sequence walks the stores in order and stops at the first one that accepts the account. Because your groups must come from the accepting store, sequence order decides whose directory names your rules see. It's an address book stack: you read the top book that actually has the name.
Full Explanation
The correct design is a single identity source sequence containing Active Directory, LDAP, and internal users, with authorization groups obtained from whichever store successfully authenticates the user. That accommodates the three account locations, keeps authentication in one rule, and preserves the required relationship between the authenticated identity and its group data. Separate PEAP-GTC rules for each population can be a reasonable design when policy needs differ, but it misses the stated requirement to authenticate every user through one rule. A sequence using PEAP-MSCHAPv2 rather than PEAP-GTC can be a familiar network-access configuration, yet it does not meet the required authentication method. A sequence that stops when a username is not found in a store also looks plausible, but it prevents the lookup from continuing: a partner absent from Active Directory would never be checked in LDAP, and a break-glass account absent from both external stores would not reach internal users. Exam caveat: identity-source sequences often have configurable handling for user-not-found and authentication errors, so do not assume every failure advances to the next source. Practical check: test one account from each store and verify both the matched identity source and the resulting group attributes in ISE authentication details.