An engineer is deploying wired 802.1X on Cisco Catalyst access switches. Each access port connects a Cisco IP phone with a PC daisy-chained behind it. The security policy requires that the phone authenticate in the voice domain and the PC authenticate independently in the data domain, but no more than one endpoint should ever be authorized in the data domain on a single port. Which switchport host mode meets these requirements?