Refer to the exhibit.

A Cisco ISE downloadable ACL is delivered as part of RADIUS authorization using Cisco vendor-specific attributes. The switch must therefore be enabled to process authentication VSAs with radius-server vsa send authentication, making D correct. The exhibit already contains switchport mode access, so B adds nothing. ip access-group ACL-NAME out applies a locally configured static ACL and does not enable ISE to download a per-session ACL. authentication order mab dot1x changes the order of endpoint authentication methods; it does not enable dACL delivery. Cisco’s documented ISE switch configuration guidance describes radius-server vsa send authentication as the command that enables authentication vendor-specific attributes. Once the switch accepts the Cisco AV-pairs returned by ISE, it can request and apply the authorized dACL dynamically to the authenticated session.

================