Contractors who authenticate with 802.1X through Cisco ISE must reach only two application servers, while employees on the same switches keep normal access. The engineer wants the restriction applied per session from ISE. What should the contractor authorization profile return?
Select an answer to reveal the explanation.
Short Explanation
Here's the beauty of a dACL: you let ISE hand the switch a custom rule sheet just for that one session. Employees on the next port never see it. A static port ACL is the trap, because it treats everyone on the port the same no matter who logs in.
Full Explanation
An ISE authorization profile defines the result returned when an authorization rule matches. It can include a VLAN assignment, a security group tag, URL redirection, or a downloadable ACL. A dACL is defined centrally in ISE and pushed to the switch in the RADIUS exchange, where it is applied to that session's traffic only. Returning a dACL that permits the two application servers and denies everything else enforces the contractor restriction per user session without changing switch configuration, while employee sessions on the same switch receive their own, broader profile. A static port ACL configured on every access port affects everyone who connects to those ports and cannot distinguish contractors from employees. An Access-Reject denies the session entirely; RADIUS does not reject individual traffic flows after authorization, so this cannot implement selective access. A posture requirement assesses endpoint health and does not restrict reachable destinations on its own. Exam caveat: dACLs on switches require that the session has an IP address association, often via IP device tracking, and many designs keep a default port ACL in place as a baseline. Operational check: display the authentication session details on the switch and confirm the contractor session shows the expected dACL applied.