Exam 300-715 topic 1 question 64 discussion

Answer is C

The correct answer is - Add each MAC address manually to a blocklist identity group and create a policy denying access. To accomplish this task, the Cisco ISE administrator must follow these steps: Create a blocklist identity group. Add each MAC address of the endpoints that must be restricted from accessing the network to the blocklist identity group. Create a policy that denies access to the blocklist identity group. Apply the policy to the network access devices.

Blocklist" identity group is a feature that allows you to define a group of identities (users or endpoints) that should be denied network access based on specific criteria. can be configured based on various criteria, such as usernames, MAC addresses, IP addresses, device attributes, or other identity attributes. You can manually add identities to the Blocklist group or dynamically populate the group using various identity sources, such as Active Directory, LDAP, or RADIUS.

C since the question is about specific endpoints, not endpoint types.

C is more appropriate-- a logical profile must be matched based n a profiler result. there is no assurance that the devices will get profiled properly or at all. A mac address is something you get right away and is absolute.

B is the right one. @kingsalah1982 , C could work as well but MAC can be easily spoofed so that's not best practice.

B is a bit organized way but alternate could be C.