Which mechanism does Cisco ISE use to force a device off the network if it is reported lost or stolen?

Which mechanism does Cisco ISE use to force a device off the network if it is reported lost or stolen?

A.
CoA

B.
dynamic ACLs

C.
SGACL

D.
certificate revocation