A Cisco XDR analyst confirms an endpoint is compromised and wants to quarantine it on the network immediately through Cisco ISE, without logging in to the switch. Which mechanism makes this possible?
Select an answer to reveal the explanation.
Short Explanation
Here's the relay race: you click in XDR, XDR passes the baton to ISE, ISE tags the host with a quarantine policy, and CoA forces the switch to reauthorize the session right now. No CLI, no truck roll. Endpoint isolation is the tempting answer, but that works on the host, not the switch port.
Full Explanation
Cisco ISE Adaptive Network Control, often used in rapid threat containment designs, lets an administrator or an integrated product apply an ANC policy, such as quarantine, port bounce or shutdown, to an endpoint by MAC or IP address. Products such as Cisco XDR and Secure Firewall can request the action through pxGrid or the ISE API. ISE then sends a Change of Authorization to the network access device; the session is reauthorized, an authorization rule that checks the ANC policy matches, and a quarantine profile such as a restrictive dACL or VLAN is applied. The containment takes effect in the network without touching the switch configuration. Pushing a static ACL through a configuration template changes switch configuration, is slow, and is not tied to the endpoint's session identity. Secure Endpoint isolation is a valid host-based action, but it is enforced by the agent on the endpoint and does not disable switch ports. A DNS block for the endpoint's hostname affects name resolution of that host, not the host's ability to send traffic, so it does not quarantine anything. Exam caveat: ANC depends on CoA working end to end. Operational check: apply the ANC quarantine and confirm the session's authorization changes in the ISE live log and on the switch.