An administrator has manually added the MAC address of a wireless device to the Blocklist Identity Group for testing. When the device connects to the wireless network it triggers the Wireless Block…

Disabling URL redirection is irrelevant to blocking access; URL redirection is typically used for guest portals or onboarding, not for denial of service.

Enabling SNMP with read and write access on the Cisco WLC is for management and monitoring of the WLC, not for enforcing specific client access policies like a blocklist.

Creating an ACL named BLOCKHOLE on the WLC might be a component of a denial strategy, but the primary missing step in ISE is applying an authorization profile that either uses such a denial ACL or directly issues an ACCESS_REJECT.

While a rule might trigger on the Blocklist Identity Group, it must apply an authorization profile that explicitly denies access. The ACCESS_REJECT Access Type within an authorization profile is the direct mechanism in Cisco ISE to explicitly deny network access to an endpoint.