A Cisco ISE dACL is delivered through Cisco vendor-specific RADIUS authorization attributes in the authentication exchange. The switch configuration already contains aaa authorization network default group ISE-GRP, so adding another network-authorization command that references a differently named group would not solve the attribute-processing failure. The required command is radius-server vsa send authentication, which enables Cisco vendor-specific attributes for RADIUS authentication and authorization processing. The accounting variant applies VSAs to accounting messages and does not enable receipt and interpretation of the authorization attributes carrying the dACL. Executive authorization controls administrative shell access rather than endpoint network authorization. Therefore, option C directly corrects the condition in which Cisco ISE sends the dACL information but the switch fails to recognize the Cisco-specific attributes. Cisco ISE switch configuration guidance