The security team identified a rogue endpoint with MAC address 00:47:44:40:54:1A attached to the network. Which action must security engineer take within Cisco ISE to effectively restrict network…

Creating an authentication policy to force reauthentication might not be sufficient, as the rogue device could still reauthenticate unless a specific deny rule is applied after authentication, which quarantine directly facilitates.

Configuring access control lists (ACLs) directly on network switches is a manual and less scalable method compared to leveraging Cisco ISE's dynamic policy enforcement capabilities for rogue devices.

Adding the rogue endpoint's MAC address to the endpoint quarantine list in Cisco ISE is the most effective action. This action assigns the endpoint to a specific identity group (e.g., 'Quarantine'), which can then be targeted by an authorization policy to enforce highly restricted access or complete denial of network services, effectively isolating the rogue device.

While the ultimate goal is to deny access, simply implementing a general authentication policy to deny access might not specifically target the rogue MAC address without first assigning it to a group like 'Quarantine' that triggers such a policy.