A hospital wants VPN posture so that fully patched laptops receive full network access, laptops with one failed check are sent to a remediation server, and devices with no posture agent still reach email only. Your policy must express all three outcomes distinctly so the help desk can tell them apart. Which posture policy structure should you configure in ISE?
Select an answer to reveal the explanation.
Short Explanation
You need three posture verdicts, each with its own access level, so the help desk can tell the outcomes apart. A device without an agent is a distinct state, not just another failed check, and your policy should handle it separately. Think of three stamps—pass, remediate, or unknown—sending each visitor down a different hallway.
Full Explanation
The correct structure returns compliant, non-compliant and unknown, with a separate authorization profile for each state. That lets fully patched laptops receive full access, laptops that fail a check reach remediation, and devices without an agent receive email-only access, while keeping all three outcomes distinguishable. A policy with only compliant and non-compliant results treats every failure alike, so an agentless device cannot be identified as unknown and may be sent to remediation instead of receiving email-only access. Returning all three states but assigning non-compliant and unknown devices the same remediation profile preserves the labels but not three distinct authorization outcomes; the help desk cannot distinguish those cases by their access. Returning three states and separate profiles but placing non-compliant laptops in a restricted VLAN gives them a different outcome from the required remediation-server access. Exam caveat: a posture state and its authorization result are related but separate; defining a state alone does not guarantee the intended access unless its profile and policy mapping are configured. Practical check: test a compliant laptop, a laptop with one failed check, and a device with no agent, then verify each assigned profile and the destinations it can reach.