A company is introducing 802.1X with Cisco ISE on 3,000 wired ports. Leadership says no user can be locked out during rollout while the team reviews which devices pass and fail authentication. Which deployment approach fits?
Select an answer to reveal the explanation.
Short Explanation
Before you lock the doors, you check whose keys actually work. Monitor mode lets everyone keep working while ISE logs who would've passed or failed. Jumping straight to closed mode is the trap; that's how you lock out the CEO's docking station on day one.
Full Explanation
Cisco recommends a phased 802.1X deployment. In monitor mode, ports run 802.1X and MAB but are configured with open authentication, so traffic is allowed regardless of the result. ISE logs every attempt, and the team can identify devices without supplicants, misconfigured supplicants and missing MAB entries before any enforcement occurs. Afterwards, low-impact mode adds a port ACL that restricts traffic before authentication while still permitting essentials, and closed mode enforces fully, allowing nothing but EAPOL until authentication succeeds. Enabling closed mode everywhere at once guarantees lockouts for every device not yet accounted for, which violates the stated requirement no matter how many help desk staff are available. Low-impact mode is the second phase; a pre-auth ACL that allows only DHCP and DNS already blocks business traffic for any device that fails, so it is not lockout-free. Disabling 802.1X and using MAB for all devices abandons strong authentication and still needs every MAC address in ISE to avoid failures, so it is neither safer nor informative. Exam caveat: monitor mode provides visibility only and must be followed by enforcement. Operational check: review ISE live logs and reports for failed authentications per switch before moving each site to the next phase.