Question

A security engineer integrates Cisco ISE with two separate Active Directory forests that have no trust relationship between them: 'corp.example.com' for employees and 'contractor.example.net' for contract staff. Both forests must be usable as identity sources for 802.1X authentication. The engineer wants ISE to try each directory in a defined order and stop at the first that can authenticate the user. Which ISE configuration meets this requirement?

Accepted Answer

Create two separate AD join points and reference them together in an Identity Source Sequence used by the authentication policy

Answer

Join ISE to only the corp.example.com forest and configure a one-way external trust so contractor accounts resolve through it

Answer

Configure a single AD join point and add both forests as additional domains under the same Active Directory scope

Answer

Use an LDAP identity store pointed at a global catalog server that indexes both forests simultaneously