What is a method used by Cisco Rapid Threat Containment to contain the threat in the network?

Cisco Rapid Threat Containment (RTC) is a framework that integrates various Cisco security products to automate threat response. When a threat is detected by a sensor like Cisco Firepower, it shares this context with the Cisco Identity Services Engine (ISE) via the Platform Exchange Grid (pxGrid). ISE then acts as the policy enforcement point. A primary method of containment is to dynamically change the Security Group Tag (SGT) of the compromised endpoint. This action leverages Cisco TrustSec to apply a more restrictive policy (quarantine or limited access), effectively segmenting the endpoint from the rest of the network and containing the threat.

A. change of authentication: This is imprecise. RTC triggers a change in authorization status (e.g., assigning a quarantine SGT), not necessarily a new authentication event itself.
B. share context data: Sharing context data via pxGrid is the mechanism that enables containment but is not the containment action itself. It is a prerequisite step.
C. TACACS+: TACACS+ is a protocol primarily used for device administration (AAA for network devices like routers and switches), not for endpoint access control or threat containment.

1. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Rapid Threat Containment" Chapter: "Cisco ISE can change the authorization state of an endpoint when it receives a high-level threat alert from the monitoring device... Cisco ISE uses the following methods to contain threats: Quarantine: Assigns the endpoint to a Security Group Tag (SGT) or VLAN that has a very restrictive access."

2. Cisco Press, "31 Days Before Your CCNP and CCIE Security Core SCOR 350-701 Exam," Day 28: Cisco ISE Posture and Quarantine: "When a threat is detected, the sensor can publish information about the threat through pxGrid. ISE can subscribe to this information and take an action, such as quarantining the endpoint by assigning it a different SGT or VLAN." (Note: While this is from a SCOR book, the technology is identical and directly applicable to the 300-710 exam domain).

3. Cisco.com, "Cisco TrustSec," Solution Overview: "Cisco TrustSec technology uses software-defined segmentation to simplify the provisioning of network access, accelerate security operations, and consistently enforce policy across the network... When integrated with Cisco ISE, it can dynamically quarantine suspicious devices." This document explains the foundational technology (TrustSec) that RTC leverages for containment.