A hospital access switch must apply three controls from a single authorization profile: place the session in VLAN 120, tag it with SGT 45 for TrustSec, and redirect HTTP to the ISE portal using an ACL already configured on the switch. Which authorization profile result set delivers all three controls together?
Select an answer to reveal the explanation.
Short Explanation
Your three requirements map onto three separate results, and the portal redirect is the tricky one. The redirect ACL acts like a signpost: it names an ACL already on the switch instead of pushing new rules. A downloadable ACL looks handy, but it doesn't send traffic to the portal.
Full Explanation
An ISE authorization profile is a bundle of results, and each result maps to one enforcement mechanism on the switch. The VLAN result carries the RADIUS attributes that reassign the port to VLAN 120, the SGT result supplies the TrustSec group tag so downstream devices can enforce policy on the session, and the redirect ACL result supplies the name of an ACL that already lives on the switch and matches the traffic destined for the portal. A downloadable ACL fails the redirect requirement, because a dACL is pushed as fresh permit and deny statements instead of naming an ACL that matches and sends HTTP traffic. Leaving out the VLAN result fails the segmenting requirement, since the port stays on whatever default VLAN is configured. Leaving out the SGT result fails the TrustSec requirement, because the frames continue untagged and no downstream group policy applies. Exam caveat: attribute names differ between IOS, NX-OS and WLC code, but the result-to-mechanism mapping is stable. Practical check: apply the profile and run show authentication sessions detail to see the VLAN, the SGT and the redirect together.