B is correct https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/ise_active_directory_integration/b_ISE_AD_integration_2x.html tab -> Active Directory Account Permissions Required to Perform Various Operations

Selected Answer: B The provided answer is correct

Selected Answer: B B is right

Selected Answer: B B is the better answer here

tricky question: but B is correct, it is what is common in both operations : join: The join operation requires the following account permissions: Search Active Directory (to see if a Cisco ISE machine account exists) Create Cisco ISE machine account to domain (if the machine account does not already exist) Set attributes on the new machine account (for example, Cisco ISE machine account password, SPN, dnsHostname) leave : The leave operation requires the following account permissions: Search Active Directory (to see if a Cisco ISE machine account exists) Remove the Cisco ISE machine account from the domain If you perform a force leave (leave without the password), it will not remove the machine account from the domain. =============== as you can see, search is the only operation (or permission) that is common

Selected Answer: B Refer to table: Active Directory Account Permissions Required to Perform Various Operations https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/217351-ad-integration-for-cisco-ise-gui-and-cli.html

Selected Answer: B The English is really bad! The join operation requires the following account permissions: Search Active Directory (to see if a Cisco ISE machine account exists) Search is NOT a permission, it is an action. I wish Cisco didn't outsource these exams!

Selected Answer: D When joining a Cisco ISE appliance to an Active Directory domain, a machine account has to be created for the appliance. This machine account is used by the appliance to authenticate to the domain and reach resources. When leaving an Active Directory domain, the machine account must be removed. The other options are not common to both the Join and Leave operations. Remove the Cisco ISE machine account from the domain: This is only required when leaving an Active Directory domain. Search Active Directory to see if a Cisco ISE machine account already exists: This can be done by any user with Read permission to the domain. Set attributes on the Cisco ISE machine account: This can be done by a user with Write permission to the domain.

Selected Answer: D The correct answer is - Create a Cisco ISE machine account in the domain if the machine account does not already exist. When joining a Cisco ISE appliance to an Active Directory domain, a machine account has to be created for the appliance. This machine account is used by the appliance to authenticate to the domain and reach resources. When leaving an Active Directory domain, the machine account must be removed. The other options are not common to both the Join and Leave operations. Remove the Cisco ISE machine account from the domain: This is only required when leaving an Active Directory domain. Search Active Directory to see if a Cisco ISE machine account already exists: This can be done by any user with Read permission to the domain. Set attributes on the Cisco ISE machine account: This can be done by a user with Write permission to the domain.