Users fail 802.1X on a wired port. The Cisco ISE live log shows the user's credentials were verified successfully against Active Directory, then the request was rejected because no authorization rule matched the user's group membership and the default rule denied access. What should the engineer do?
Select an answer to reveal the explanation.
Short Explanation
Think of it as passing the ID check at the door and then finding your name isn't on the guest list. ISE's live log tells you which step failed, and here it's authorization, not authentication. The trap is resetting passwords when the log already told you the password was fine.
Full Explanation
ISE processes a RADIUS request in stages: it selects an authentication policy, validates credentials against an identity source, and then evaluates authorization rules to choose the result. The live log details show each stage, so an entry that records successful identity verification followed by a match on the default deny rule means the user is genuine but no authorization condition, such as an AD group, matched. The fix lives in policy or in directory membership. Resetting the password targets authentication, which already succeeded; it changes nothing about which authorization rule matches. A shared secret mismatch would prevent ISE from processing the request at all or would surface as a message-authentication failure, not as a policy decision reached after a successful AD lookup. Replacing a user certificate addresses EAP-TLS identity problems, but the log shows the credential step passed, so the supplicant identity is not the issue. Exam caveat: always read where in the flow the failure occurs; credential failures, policy mismatches and device trust problems produce different log details and need different fixes. Operational check: open the failed record's details, note the attributes ISE retrieved for the user, compare the group names with the authorization rule conditions, then adjust the rule or membership and confirm the next attempt matches the intended rule.