An administrator configures Cisco Secure Firewall Threat Defense to integrate with Cisco ISE via pxGrid. Which TWO operational benefits are provided by this integration for firewall policy enforcement? (Choose two)
Consuming Security Group Tags lets the firewall enforce policy on identity-derived tags rather than IP addresses, satisfying the requirement for dynamic, tag-based microsegmentation. pxGrid streams SGT-to-IP mappings from Cisco ISE, so the Threat Defense appliance applies access filtering that follows workloads as addresses change.
Why this answer
The pxGrid integration between Cisco Secure Firewall Threat Defense (FTD) and Cisco ISE enables the firewall to subscribe to ISE's identity and context data, so option E is correct: FTD can enforce Access Control policies using user identity, username, and user group membership learned via pxGrid (identity-based firewall rules). Option D is also correct because pxGrid can deliver Security Group Tags (SGTs) from ISE, allowing FTD to perform tag-based microsegmentation and access filtering using SGT values in its rules. Option A is not provided by pxGrid integration; IDS/IPS signatures are delivered through Cisco Talos signature updates, not ISE.
Option B is incorrect because pxGrid does not stream raw PCAP files to SIEMs; it shares contextual session/identity data, and PCAP export is a separate FTD/FMC capability. Option C is incorrect because FMC administrator password management is not an ISE pxGrid function; ISE integration is about identity and group context, not managing FMC admin credentials.