Which use case validates a change of authorization?

The correct answer is B. An endpoint profiling policy is changed for authorization policy. Change of Authorization (CoA), defined in RFC 5176, allows ISE to dynamically modify the access privileges of an already-authenticated and authorized session without requiring the endpoint to re-authenticate from scratch. When an endpoint's profiling policy changes (choice B)…

Policy Enforcement

Question

Options

AAn authenticated, wired EAP-capable endpoint is discovered
BAn endpoint profiling policy is changed for authorization policy.
CAn endpoint that is disconnected from the network is discovered
DEndpoints are created through device registration for the guests

How the community answered

(39 responses)

A
3% (1)
B
87% (34)
C
3% (1)
D
8% (3)

Explanation

Change of Authorization (CoA), defined in RFC 5176, allows ISE to dynamically modify the access privileges of an already-authenticated and authorized session without requiring the endpoint to re-authenticate from scratch. When an endpoint's profiling policy changes (choice B) - for example, when ISE re-profiles a device from 'Unknown' to 'iPhone' - ISE can send a CoA message to the network access device to trigger re-authorization, applying the new authorization policy matching the updated profile. The other choices describe scenarios (disconnected devices, new registrations, EAP-capable endpoints) that do not inherently trigger a CoA for an active session.

Topics

#Change of Authorization (CoA)#Cisco ISE#Endpoint Profiling#Authorization Policy

Community Discussion

No community discussion yet for this question.

Full 300-715 Practice