A company using Cisco ISE requires that each visitor's guest account be created or approved by a front desk employee before the visitor can connect. The employee should only manage guests, not change ISE policy. Which approach meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
Think of the sponsor as the bouncer with the guest list: they can add names, but they can't rewire the club. The trap is giving the front desk an ISE admin login; you'd be handing them the keys to the whole building just to sign in visitors.
Full Explanation
In Cisco ISE sponsored guest access, a sponsor, typically a receptionist or host employee, logs in to the sponsor portal and creates guest accounts or approves self-registered requests. Sponsor group membership determines which guest types a sponsor may create, how long accounts last, and whether the sponsor can manage accounts created by others. Sponsors do not receive ISE administrative access, so they cannot change policies, which satisfies the least-privilege requirement. A hotspot portal requires no account and no approval, so it removes the employee involvement the requirement demands. Granting the Super Admin role gives the front desk full control of ISE, which is far beyond guest management and is a serious separation-of-duties failure. Registering visitor MAC addresses for MAB is operationally heavy, provides no visitor identity or approval workflow, and trusts an easily spoofed attribute. Exam caveat: self-registered guest portals can also be configured to require sponsor approval, which is still a sponsored model. Operational check: log in to the sponsor portal with a front desk account, create a test guest, and confirm that the account cannot reach any ISE administration menus.