A bank must grant the payment-application VLAN only when three conditions hold at once: the user sits in the AD group PAY-ADMINS, the endpoint profile is Corp-Laptop, and the session arrived from the 10.40.0.0/16 branch range. The same decision has to serve wired and wireless policies without duplicated rules. Which policy construct should the engineers build?
Select an answer to reveal the explanation.
Short Explanation
A compound condition stacks those three checks into one named element that both policies point at, so you change the range once and every use updates. One master key beats recutting a pile of copies. An authorization profile only hands out results; it can't test who, what or where.
Full Explanation
ISE authorizes by matching a session against conditions, and a condition is an expression over attributes: Active Directory supplies group membership, the profiler supplies the endpoint profile, and an endstation network condition supplies the client address range. Building one compound condition that ANDs those three legs gives the whole test a name in the Conditions Studio library, so the wired rule and the wireless rule point at the same element and a subnet or group change is made once. Writing separate rules per access type gets the logic right but duplicates the matching work, and the two copies can drift apart when someone edits one. Putting the payment VLAN inside the authorization profile and leaning on the authentication policy mistakes the result for the test: an authorization profile assigns outcomes, while authentication policy handles authentication and identity-source selection rather than authorization. Keying the assignment on the identity group covers the group leg but drops the other two, leaving an unmanaged device from outside the branch range qualified. Ensure ISE has the endpoint's IP address available; otherwise the range condition cannot match. Practical check: test wired and wireless clients inside and outside the range, and confirm the relevant rules use the same compound condition in Live Logs.