An administrator must enable scanning for specific endpoints when they attempt to access the network. The scanning must be triggered as a result of successful authentication. Which action…

init_endpoint_scan is not a standard authorization result to be sent to an authenticator for initiating a scan directly; scanning is typically controlled via authorization profiles.

In Cisco ISE, endpoint scanning (e.g., posture assessment) is often initiated via an authorization profile. By creating a profile that includes scanning actions and then assigning this profile as the authorization result for specific endpoints or user groups, scanning is triggered immediately following successful authentication.

Adding an entry to authentication conditions to allow only scanned endpoints would prevent initial access for unscanned endpoints, which contradicts the goal of triggering scanning after successful authentication.

Configuring the endpoint scanning probe is part of the setup, but it doesn't trigger the scan itself as a result of successful authentication; the authorization policy determines when the scan is initiated.