An IP phone and a PC daisy-chained behind it share one switch port. Both must authenticate separately through Cisco ISE, with the phone placed in the voice VLAN and the PC in the data VLAN. Which host mode supports this?
Select an answer to reveal the explanation.
Short Explanation
One port, two tenants, and you want each one checked: the phone gets the voice room and the PC gets the data room, and each one shows its own ID. That's multi-domain. Multi-host is the trap; it lets the first device vouch for everyone behind it, so the PC never proves who it is.
Full Explanation
Host modes control how many endpoints may authenticate on a switch port and how. Multi-domain authentication allows one endpoint in the data domain and one in the voice domain, each authenticated independently. ISE identifies the phone, typically through MAB or 802.1X with profiling, and returns the device-traffic-class voice attribute in its authorization profile, which tells the switch to place it in the voice VLAN. The PC authenticates separately and is placed in the data VLAN. Single-host mode allows only one MAC address on the port, so the second device triggers a security violation and the phone and PC cannot coexist. Multi-host mode authenticates the first device and then permits every other device on the port without authentication, which fails the requirement that both authenticate separately. Monitor mode is a deployment phase using open authentication, not a host mode, and it does not enforce separate VLAN assignment for the two devices. Exam caveat: multi-auth mode also authenticates each device individually and supports one voice device plus multiple data devices, but on the exam the classic phone-plus-PC design is multi-domain. Operational check: display the authentication sessions on the port and confirm two sessions, one in the voice domain and one in the data domain.