An administrator must block access to BYOD endpoints that were onboarded without a certificate and have been reported as stolen in the Cisco ISE My Devices Portal. Which condition must be used when configuring an authorization policy that sets DenyAccess permission?

When an end-user reports a device as lost or stolen through the Cisco ISE My Devices Portal, ISE automatically performs two actions: it moves the endpoint to the 'Blacklist' endpoint identity group and updates the BYODRegistrationStatus attribute for that device to either 'Lost' or 'Stolen'. To block network access, an authorization policy must be configured to match these attributes. The policy condition should check if the Endpoint Identity Group is 'Blacklist' (or 'Blocklist' as used in the option) and if the BYOD state reflects that it has been reported missing. Among the choices, 'Lost' is the correct state that, along with 'Stolen', signifies a device that should be denied access.

A. The BYOD state changes from 'Registered' once the device is reported as stolen, so this condition would fail to match.
B. The 'Pending' state applies to devices that have not yet completed the BYOD onboarding process, not to already onboarded and subsequently stolen devices.
D. 'Reinstate' is the administrative action taken to restore network access to a device that was previously reported lost or stolen and has been recovered.

1. Cisco Identity Services Engine Administrator Guide

Release 3.1

"My Devices Portal" section: "When an employee reports a device as lost or stolen

Cisco ISE automatically adds the device to the Blacklist identity group. You can configure authorization policies to check whether a device is in the Blacklist identity group and deny it network access." This confirms that reporting a device as stolen moves it to the Blacklist group.

2. Cisco Identity Services Engine Administrator Guide

Release 3.1

"Cisco ISE Dictionaries" chapter

"BYOD Dictionary" section: This section details the BYODRegistrationStatus attribute

which can have the values Registered

Pending

Lost

and Stolen. This confirms that 'Lost' is a valid state for a device reported missing via the My Devices Portal

which is used in authorization policy conditions.

3. Cisco Live Presentation

BRKSEC-3699 - "Advanced ISE Services

Tips and Tricks" (2019)

Slide 45

"BYOD - Lost/Stolen Device Handling": The presentation shows an example authorization policy for lost or stolen devices. The condition logic is If (Network Access:BYODRegistrationStatus EQUALS Lost) OR (Network Access:BYODRegistrationStatus EQUALS Stolen) Then DenyAccess. This demonstrates that 'Lost' is a key state used in policies to block access for missing devices.