BYOD (15%)

SISE · 45 questions

• A regional hospital wants staff to use personal phones and tablets on the corporate Wi-Fi while those devices stay outside mobile device management. Self-registration must be limited to employees who sign in first, and every device must receive its own client certificate for network access. Which BYOD onboarding capability delivers all three requirements at once?
• A hospital is switching on BYOD onboarding for its clinical access switches. Clients must receive an address by DHCP, resolve the portal name with the internal DNS server at 10.10.0.10, and reach the onboarding portal on PSN 10.10.50.10 over TCP 80 and 443 while staying blocked from everything else until onboarding finishes. Which pre-authentication ACL belongs on those access ports?
• An insurance firm allows staff to use personal phones on the corporate WLAN. Policy says each phone must end up with its own certificate-based identity rather than the employee's password, and phones that skip onboarding must stay on limited access. Which BYOD onboarding flow gives each phone its own certificate while keeping skipped phones limited?
• A 120-person design firm wants staff to self-onboard personal laptops and phones to corporate Wi-Fi using certificate-based EAP-TLS, with certificates issued by ISE itself and almost no help-desk time. Which BYOD component set in ISE delivers that onboarding?
• An ISE BYOD deployment limits each employee to two registered personal devices. An employee who has hit the limit wants to add a new tablet and no longer carries an older phone that is still listed. Which BYOD device-lifecycle action should the engineer take first?
• A regional bank lets staff use personal laptops on the corporate WLAN and wants the whole registration flow to live on that one network. Users join a single SSID, land on the BYOD portal, install a provisioning profile, then reconnect using the certificate the internal CA issued. Which BYOD onboarding pattern fits a single SSID with certificate-based return access?
• A regional airline issues company tablets to cabin crew and lets staff use personal phones for email and the crew portal. Staff must enroll their own devices, access must survive restarts with no credential prompts, a single lost device must be revocable, and identity must resist MAC-address cloning. Which BYOD capability meets these requirements?
• A state university lets personal devices onto its secure WPA2-Enterprise network, but campus RF policy allows no SSID beyond the existing secure network and the visitor network, and employees are barred from onboarding over the visitor network. The devices have no MDM, every one of them supports 802.1X and can initially authenticate with employee credentials using a certificate-free EAP method, and each must end up holding an ISE-issued device certificate for EAP-TLS. Which BYOD flow meets these constraints?
• A design agency wants 120 employees to use personal laptops on the corporate WLAN. Staff must enroll and remove their own devices without IT visiting each desk, access must be EAP-TLS with a per-user certificate from the company's own CA, and every registered device must remain listed while registered. Which BYOD components in ISE meet these enrollment requirements?
• A university runs BYOD on a Catalyst access switch and a 9800 WLC. Students authenticate with 802.1X and should be sent to the ISE onboarding page as soon as they join, while DHCP, DNS and portal traffic must still pass before authorization completes. Which redirect ACL design works on both the switch and the controller?
• A 400-bed hospital is enabling BYOD with ISE and EAP-TLS. Laptops enroll through SCEP against the hospital's internal Microsoft CA and receive a user certificate, yet ISE rejects every session because it cannot build a trusted chain to the issuing CA. The team must keep the existing CA hierarchy and let devices enroll unattended. Which change makes ISE trust the endpoint certificates issued during BYOD enrollment?
• A 300-person design agency wants staff laptops to join WPA2-Enterprise using EAP-TLS. IT will not ask users to install certificates by hand, and the issuing CA must be ISE itself. On first connection each laptop walks through registration, receives its supplicant settings, and is issued a certificate before normal access is granted. Which ISE components complete this first-time BYOD onboarding flow?
• An employee reports a missing laptop during a security review. The laptop holds a BYOD certificate issued through ISE, and the same user still carries a phone and a tablet that must keep working. The team needs to end the lost laptop's EAP-TLS access while the user's other registered devices continue normally. Which BYOD lifecycle action should the analyst take?
• A hospital wants company laptops and staff-owned phones to share one SSID so the WLAN build stays identical across twelve sites. Staff must sign in with their directory account over 802.1X on that SSID, then register the personal device so it reconnects on its own, while visitors stay on a separate network. Which BYOD design delivers that single-SSID flow?
• A 200-person software firm wants personal laptops on the secure WLAN using EAP-TLS instead of a shared key. Staff can self-serve through a portal, but IT has refused to install software or certificates by hand on every laptop. Which BYOD enrollment path gives each user a certificate-based 802.1X identity with the least manual work?
• Your controller runs an employee WLAN with EAP-TLS and a separate BYOD WLAN where laptops open the portal, enrol with the internal CA, then rejoin with a certificate. On the BYOD WLAN, DNS and DHCP must keep working during the wait, the HTTPS portal must be reachable, authorized devices must work without a second redirect, and the employee WLAN must stay untouched. How must the redirect ACL be scoped and what should it permit?
• A logistics company is starting BYOD, and policy requires every certificate to be issued by ISE itself, with outside certificate authorities out of scope for this budget cycle. Phones must verify the ISE server during EAP-TLS, ISE must validate each issued endpoint certificate, and users must enroll on their own without a help-desk ticket. Which certificate design meets these BYOD requirements?
• A design firm will broadcast only one SSID: WPA2-Enterprise for 45 employees bringing personal laptops and phones. IT requires 802.1X on that SSID and wants employees to register their own device over the air and then keep working on the same SSID with device rights. Which BYOD flow fits these requirements?
• A regional hospital is onboarding 400 clinician iPads to BYOD. The devices sit outside the domain, keys must be generated on each iPad, the identity must come from the corporate Windows CA, and the tablet has to trust that CA before it accepts the profile. Which certificate template design supports this enrollment?
• A bank lets staff use personal laptops and tablets on the corporate WLAN. Each user must run a self-service enrollment once at onboarding that installs a client certificate, and every enrolled device must land in a role that reaches business services rather than the whole corporate network. Which ISE BYOD onboarding design satisfies the enrollment, certificate, and access requirements?
• A retail chain runs BYOD on Cisco 9200 switches in the stockroom and a 9800 controller on the sales floor, both redirecting to ISE. Onboarding needs the portal reached over HTTPS, names resolved first, and everything else blocked before registration. Which redirect ACL design satisfies those three requirements on both platforms?
• A regional clinic can broadcast only one staff SSID. Laptops already authenticate to it with 802.1X, while staff phones arrive unenrolled and must pass through ISE's onboarding portal to receive certificates before they are trusted. Which BYOD flow fits this single-SSID site?
• A company lets employees register personal laptops in the ISE My Devices Portal, and each person may enroll several devices. One employee is returning a company laptop to IT, so only that laptop's registration should be removed while the person's phone and tablet keep their registered access. Which action revokes this single device's BYOD registration?
• A logistics firm enables BYOD onboarding on its Cisco access ports. Any device that fails 802.1X must reach the ISE self-registration portal, resolve that portal by name over DNS, download its provisioning profile from ISE's internal CA, and remain isolated from internal application servers until onboarding completes. Which policy design meets these requirements?
• A design agency with 600 personal phones and tablets allows BYOD on the corporate WLAN. Staff open the BYOD portal from the guest page, accept the usage terms, and register the device; every certificate must come from ISE's internal CA and arrive through the self-service flow, and each device must authenticate with its own certificate rather than the employee's directory password. Which BYOD component sequence delivers that certificate?
• A regional insurer lets each employee register up to three personal devices through the BYOD portal and remove their own devices through that same portal instead of a service ticket. When a device is lost or reassigned, revoking it must cut access right away, and that device must re-enroll before it returns. Which BYOD lifecycle design satisfies both the device limit and the revocation flow?
• A university is starting BYOD onboarding for student laptops. The registration pages must open without any browser certificate warning, the certificates issued to endpoints must come from an ISE certificate template, and ISE must accept those endpoint certificates for EAP-TLS afterwards. Which certificate configuration satisfies all three requirements?
• A university enables BYOD on the campus wireless network and on wired dormitory ports. Endpoints must be redirected to the ISE onboarding portal before they gain access, and during registration they must get an address, reach DNS, the ISE portals and an internal issuing CA on a separate subnet to install their certificate. Everything else stays blocked until onboarding finishes. Which pre-auth ACL content allows registration while keeping the port locked down?
• A retail chain is starting BYOD across 120 stores. Laptops enroll at the ISE BYOD portal, the corporate CA signs each device certificate through SCEP, and ISE's EAP server certificate comes from that same corporate CA. Each issued certificate must carry the signed-in employee's identity, and both sides must validate the certificate the other presents. Which certificate template and trust configuration covers every check?
• A 300-person company onboards devices using ISE and its WLAN controller only, and wants employees to register personal phones, receive the wireless settings automatically, and have the endpoint record tied to the person who registered it. Which ISE BYOD use case should be configured?
• A telecom's field engineers each carry a company phone and a personal laptop, both onboarded through BYOD and listed under their internal user record. One laptop is reported stolen, and policy requires that only that laptop stops authenticating, the phone keeps working, the laptop must re-enroll before rejoining, and a replacement can still be registered. Which ISE action satisfies all four requirements?
• A municipal office must let staff self-register personal laptops on the corporate WLAN. The building contract allows only one SSID per floor, and policy requires every BYOD device to hold a certificate from the internal CA before it can reach file shares. Which BYOD registration flow meets all three requirements?
• A 300-person finance firm wants staff to use personal laptops and phones on the corporate WLAN. Each device must sign in with the employee's directory credentials, receive a device identity certificate during onboarding, land in a limited-access segment, and keep the user in full control of the device. Which BYOD use case in ISE meets all four requirements?
• A 400-person insurer is turning on BYOD self-registration for personal phones. During onboarding each phone must receive a client certificate that ISE will accept for EAP-TLS, the phone must verify ISE's server certificate during the TLS handshake, and the certificates must be issued by ISE's internal CA, and the security team requires each phone to build its own trust chain. Which certificate arrangement satisfies the BYOD trust requirements?
• A 400-person insurer runs ISE BYOD with the per-user registration limit set to two devices. An analyst has a laptop and a phone registered, has lost the phone, and wants to onboard a tablet this morning, but the My Devices portal refuses the third registration. Which action lets the analyst register the tablet while revoking the lost phone?
• Your company is starting a BYOD program for 400 employee laptops that must join the corporate WLAN with 802.1X EAP-TLS. The security lead wants certificate lifecycle and user enrollment handled inside ISE through a guided browser flow rather than emailed files. Which BYOD component workflow should you design for supplicant and certificate provisioning?
• A 120-person law firm lets partners use their own laptops to reach the document portal, and each laptop must pass 802.1X using a device certificate. IT requires that personal hardware stay free of MDM enrollment. Which BYOD registration approach should the firm use for the personal laptops?
• A 400-person firm runs ISE as its only infrastructure beyond the network gear, so every certificate and profile must come from ISE itself. Staff must register their own smartphones from a web portal, have the 802.1X supplicant configured automatically for certificate-based login, and receive a device certificate while onboarding on their own. Which ISE BYOD component delivers this workflow?
• A bank is rolling out BYOD onboarding on Catalyst access switches, with the ISE internal CA issuing device certificates. Unauthenticated laptops must still resolve DNS and reach the BYOD portal, traffic headed to the ISE server stays outside the redirect match, and the switch must intercept browser requests on standard web ports. Which switch-side redirect configuration should be deployed for BYOD onboarding?
• A regional hospital wants staff using personal phones on the corporate WLAN. Staff must enroll their own devices themselves, with the help desk out of the loop, each phone must connect with EAP-TLS using a certificate issued during that enrollment, and the resulting access must follow the user's identity group rather than the phone's MAC address. Which ISE BYOD provisioning workflow meets all three needs?
• A hospital wants a single wireless network name for staff and personal devices. Employees with unregistered phones must reach a portal, install the onboarding profile, then connect with certificate-based authentication without joining a second network. Which single-SSID BYOD onboarding flow should be configured?
• A bank lets staff keep personal laptops registered through the ISE My Devices portal, and only registered endpoints may reach the finance VLAN. One analyst is retiring her laptop today, her company tablet must keep finance access for another month, and IT's inventory must show the laptop as unregistered. Which BYOD action delivers the right revocation scope?
• A distribution centre is adding ISE-based BYOD to its wireless network, but the site broadcasts a single SSID: 200 handheld scanners were provisioned with that exact profile and the reconfiguration window has closed. Staff must still earn a client certificate before they reach the inventory VLAN, so first-time users need a guided onboarding path. Which BYOD flow fits this one-SSID deployment?
• A 400-person law firm is moving associates' personal phones and laptops off the open guest WLAN. The devices sit outside the corporate domain, IT refuses to walk users through manual certificate steps, and every onboarded device must later authenticate to the corporate SSID with a certificate ISE issues. Which BYOD onboarding design meets those requirements?
• A fintech firm rolls out BYOD with EAP-TLS, and every laptop receives a certificate from the corporate issuing CA during registration. The supplicants accept ISE's server certificate, but ISE rejects the laptop certificates as untrusted. Which trust relationship must ISE hold to validate the endpoint certificates?