Which component determines whether a wired client is allowed access when connecting to an SD-Access edge switch?

The Identity Services Engine (ISE) is the correct answer because it acts as the policy enforcement point in Cisco SD-Access. When a wired client connects to an SD-Access edge switch, the switch sends an authentication request to ISE. ISE then evaluates the client's credentials and posture against defined policies to determine if the client is authorized to access the network. If authorized, ISE instructs the switch to grant access and apply the appropriate network segmentation and policies. While an edge node (the SD-Access term for an edge switch) is where the client physically connects, it relies on ISE for access control decisions. A RADIUS server is a general authentication, authorization, and accounting (AAA) protocol, but in SD-Access, ISE is the specific implementation that provides these services along with advanced policy capabilities. A control-plane node manages the network's forwarding information and policies but doesn't directly handle client access authentication.