What is one requirement for locking a wired or wireless device from ISE?

A.
The ISE agent must be installed on the device.

B.
The device must be connected to the network when the lock command is executed.

C.
The user must approve the locking action.

D.
The organization must implement an acceptable use policy allowing device locking.

Explanation:
BD
Agents are applications that reside on client machines logging into the Cisco ISE network. Agents can be
persistent (like the AnyConnect, Cisco NAC Agent for Windows and Mac OS X) and remain on the client
machine after installation, even when the client is not logged into the network. Agents can also be temporal (like
the Cisco NAC Web Agent), removing themselves from the client machine after the login session has
terminated.
Source: http://www.cisco.com/c/en/us/td/docs/security/ise/2-0/admin_guide/b_ise_admin_guide_20/
b_ise_admin_guide_20_chapter_010101.html