---
title: "Use case 2: Policy Criteria Evaluation Hierarchy"
canonical: "https://docs.infoblox.com/space/DeploymentGuideTDIntegrationCiscoISE/1544651170/Use%20case%202%3A%20Policy%20Criteria%20Evaluation%20Hierarchy"
format: markdown
---
Verify that policy conditions are applied in the correct order of precedence—subnet-level conditions take priority, followed by IP Space object conditions, and then Data Connector Destination conditions.

Add a tag to the subnet created to define the DHCP IP range with key as **‘policy_apply_criteria’** and value as ‘(Severity = high and Confidence = high) and (policy_name = Default Global Policy)’

Change the value for the variable PolicyApplyCriteria in Data Connector Destination to ‘(Severity = medium and Confidence = high) and (policy_name = Default Global Policy)’

When the command `dig maximilliansheenagh[.]net[.]` is executed, the endpoint is not quarantined because the domain's severity is High and confidence is Medium, which does not meet the quarantine criteria set in the subnet section.

![image-20250620-045845.png](media://c8ca7b37-ce59-4f07-9227-4f7b5f8f8024)

When the command `dig magdalenawashington[.]net[.]` is executed, the endpoint is quarantined because the domain's severity is High and confidence level is High, which meet the quarantine criteria set in the subnet section.

![image-20250620-045933.png](media://6b5ea34c-e2f1-4505-9884-75bd8553acc9)

![image-20250620-045957.png](media://3d162753-59ea-4742-9d42-b714f8c1c2ef)

![image-20250620-050036.png](media://75d6ad7a-7a2c-4315-8f9e-64f18f88037d)

![image-20250620-050057.png](media://b752d34b-157f-4b8b-b0b9-d1d873d073d7)

![image-20250620-050119.png](media://df237fd4-a777-422b-b7c3-ddc1f5c31287)