In a Cisco ISE deployment, which traffic is permitted by the default dynamic ACL?