An engineer must develop a policy that utilizes AD group membership on Cisco ISE. Which type of policy element must the engineer configure to create an AD group within a policy?

In Cisco ISE policies, conditions are used to evaluate specific criteria, such as user or endpoint attributes, to determine if a policy rule should be applied. Active Directory group membership is a common attribute used within conditions to match users belonging to particular AD groups, allowing the policy to grant or deny access accordingly.

Results define the action taken by the policy (e.g., permit access, assign VLAN) if the conditions are met; they do not define the group membership itself.

Dictionaries define the attributes that can be used in policies, but they are not the elements where specific AD groups are configured for use within a policy. AD groups are attributes referenced in conditions using dictionary values.

Smart conditions are predefined, complex conditions, but the fundamental element used to create a custom AD group check is a standard condition.