Quick Answer

The correct order of ISE RADIUS policy evaluation is authentication policies first, then authorization policies, and finally the default rule, with the NAD receiving either an Access-Accept or Access-Reject as the last step. This sequence is critical because Cisco ISE must first verify the user’s identity through authentication before it can apply any condition-based authorization rules; if no authorization policy matches, the default rule enforces a fallback action. On the ENCOR 350-401 exam, this drag-and-drop question tests your understanding of the policy evaluation flow, and a common trap is placing the default rule before the authorization policies or confusing the final message exchange with an earlier step. Remember that authentication is always the gatekeeper—without a successful authentication, authorization never runs. A simple memory tip is “Auth then Authz, then Default, then Reply,” which maps to the four key stages: authenticate, authorize, fallback, and respond.