A hospital has 40 infusion pumps that must always match an authorization rule keyed on a restricted endpoint identity group, because moving them breaks the clinical VLAN policy. During a firmware rollout the profiler sees incomplete DHCP data for these devices. Which endpoint identity assignment keeps the group membership stable?
Select an answer to reveal the explanation.
Short Explanation
You're pinning the group to the device instead of letting the profiler guess it. Like nailing a nameplate to a door rather than reprinting it after each inspection, the static assignment keeps the group membership stable. Your downstream rule then matches on every login, thin probe data or not.
Full Explanation
Static assignment is correct because it pins each pump's endpoint identity group membership to its MAC address rather than to attributes that profiling infers. When an endpoint is statically assigned, the profiler continues to update its profile attributes but does not move it out of the assigned group, so the authorization rule keyed on the restricted group keeps matching even while DHCP data is incomplete during the firmware rollout. A model-based profiling policy that maps pumps to the group is dynamic: the assignment depends on probe results, so incomplete or changing attributes can still change or lose membership, contrary to the stability requirement. Matching pump MAC addresses directly in an authorization rule can grant access, but it bypasses the endpoint identity group, so the existing group-keyed rule and anything else that reads the group still do not see the pumps. Raising profiler certainty thresholds does not remove the dependency on probe data; with incomplete DHCP evidence it would more likely leave the pumps Unknown, and a profile can still change group assignment later. Exam caveat: a stable identifier alone is not sufficient unless the authorization policy actually consumes the intended endpoint identity group. Practical check: verify all 40 MAC-to-group assignments, force a profiling update on one pump, and confirm in the authorization logs that it retains the group and receives the intended access.