An organization wants mobile devices to receive full network access only if its MDM reports them as enrolled and compliant; other devices should be redirected to enroll. Which design achieves this?
Select an answer to reveal the explanation.
Short Explanation
ISE is the bouncer and the MDM keeps the guest list of compliant devices. Wire them together and ISE can ask, "Is this phone enrolled and compliant?" before letting it in, or send it off to enroll. You don't turn the MDM into the bouncer itself.
Full Explanation
Cisco ISE supports integration with MDM and enterprise mobility management platforms through an API. During authorization, ISE can query the MDM for a device's state, using attributes such as whether the device is registered and whether it is compliant, and use those attributes in authorization rules. A compliant, enrolled device receives full access, while an unregistered or noncompliant device receives a restricted profile that redirects it to the MDM enrollment or remediation page. That satisfies both the access decision and the redirect requirement. Port security limits MAC addresses on a switch port; it does not know MDM status, it does not apply to wireless, and it cannot redirect a device to enroll. MDM platforms are not designed to act as the RADIUS authentication server for the network; ISE remains the policy server and consults the MDM as an external data source. DHCP snooping prevents rogue DHCP servers and builds a binding table, but it does not evaluate device compliance and does not decide which clients receive addresses based on MDM status. Exam caveat: compliance can change after a device connects, so periodic MDM compliance checks and change of authorization keep access aligned. Operational check: connect an unenrolled test phone, confirm that it is redirected to enrollment, then enroll it and verify that it receives the full-access profile.