A network administrator is configuring client provisioning resource policies for client machines and must ensure that an agent pop-up is presented to the client when attempting to connect to the network Which configuration item needs to be added to allow for this'?

The agent pop-up is presented to the end-user through the Client Provisioning Portal (CPP). To direct an endpoint to this portal, a network administrator must configure an authorization policy in the Cisco Identity Services Engine (ISE). This policy uses an authorization profile configured for Web Redirection. The redirection action points the user's web browser to the specific URL of the CPP. When the user's initial HTTP request is intercepted, ISE returns this redirection, causing the user's browser to load the portal page, which then prompts for the agent download and installation.

B. a temporal agent that gets installed onto the system: The temporal agent is a potential outcome of the client provisioning process, not the configuration item that initiates the pop-up prompt.
C. a remote posture agent proxying the network connection: A posture agent's function is to assess endpoint compliance, not to proxy network connections. The pop-up appears before the agent is installed.
D. an API connection back to the client: Client provisioning is initiated via an HTTP-based web redirection from the network access device to the client's browser, not through a direct API call to the client.

1. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Client Provisioning Policies" section: "When a user tries to access the network, the authorization policy redirects the user to the Client Provisioning portal. The rules that you define in the client provisioning policy determine the agent and resources that must be downloaded to the client for compliance." This confirms the authorization policy is the trigger for redirection.

2. Cisco Identity Services Engine Administrator Guide, Release 3.1, "Configure Authorization Profiles for Posture" section: This section details the configuration steps, stating, "In the Authorization Profile window, enter the name and description. From the Access Type drop-down list, choose ACCESSACCEPT. Check the Web Redirection check box... Choose Client Provisioning Portal from the drop-down list." This explicitly links the authorization profile (used in an authorization policy) to the Client Provisioning Portal redirection.

3. Cisco Press, "300-715 SNCF Official Cert Guide," Chapter 10, "Configuring Client Provisioning": "The client provisioning process begins when a user connects to the network and the authorization policy redirects the user to the Client Provisioning portal... The authorization profile is configured for web redirection to the Client Provisioning portal." (This is a conceptual reference to the official study material's content structure, which aligns with vendor documentation).