Corporate laptops connecting through Cisco ISE must have critical OS patches installed. Laptops missing them should not be blocked outright; they should receive only enough access to fix the problem and then gain full access. Which approach meets this requirement?

Posture assessment in Cisco ISE uses an agent on the endpoint to evaluate conditions such as installed patches, antimalware and disk encryption against posture requirements. Until the result is known, and while the device is noncompliant, ISE applies an authorization profile with limited access, typically a downloadable ACL or restricted VLAN that permits only remediation resources such as patch servers. The agent can guide or perform remediation, and when the endpoint reports compliant, ISE issues a change of authorization to move it to full access. That matches the requirement exactly: no outright block, access limited to fixing the problem, and automatic promotion afterward. MAC Authentication Bypass authenticates a device by its MAC address and knows nothing about installed patches. A deny-all profile blocks noncompliant laptops completely, which the requirement rules out, and it pushes remediation onto manual help-desk work. A guest portal is designed for visitor access and does not evaluate or remediate corporate laptops. Exam caveat: posture requires a supported agent or agentless method, and devices without one remain in the posture-unknown state. Operational check: connect a laptop missing a required patch, confirm that it receives the remediation profile and can reach only the patch server, then patch it and verify the change of authorization to full access.