A corporate laptop passes 802.1X authentication through Cisco ISE, but policy says it must not receive full network access until its antivirus and patch level are confirmed. How should ISE enforce this?
Select an answer to reveal the explanation.
Short Explanation
Getting through the front door isn't the same as getting the run of the house. Authentication says who you are; posture says whether your laptop is healthy, and the authorization rule checks both. Failing the login sounds strict, but then the laptop can't even reach the servers it needs to fix itself.
Full Explanation
Cisco ISE separates authentication, which proves identity, from authorization, which decides what access to grant. With posture, the authorization policy uses posture status as a condition. A successfully authenticated laptop whose posture is unknown or noncompliant receives a limited authorization, often a redirect to the client provisioning portal plus a dACL allowing only ISE and remediation servers. Secure Client with the ISE posture module assesses the endpoint, reports the result, and ISE issues a change of authorization so the session is reauthorized as compliant with full access. Failing authentication for a posture issue blocks the device completely, including the remediation path, and confuses identity failures with health failures. Profiling identifies device type from network attributes, and a laptop correctly identified as a Windows workstation can still have outdated antivirus, so profiling cannot confirm compliance. Placing the laptop in the guest VLAN gives it internet access but usually no path to internal patch servers and mixes corporate assets with visitors, which is the wrong remediation design. Exam caveat: posture requires an agent or a temporal agent on the endpoint. Operational check: verify in live logs that the session hit the posture-unknown rule first and then the compliant rule after CoA.