A regional bank lets staff use personal laptops on the corporate WLAN and wants the whole registration flow to live on that one network. Users join a single SSID, land on the BYOD portal, install a provisioning profile, then reconnect using the certificate the internal CA issued. Which BYOD onboarding pattern fits a single SSID with certificate-based return access?
Select an answer to reveal the explanation.
Short Explanation
A single-SSID flow keeps your employee on one network while a web redirect carries the browser to the onboarding page. Once the profile and certificate land on the device, it's just an EAP-TLS handshake on that same SSID.
Full Explanation
In the single-SSID flow, the endpoint's first association is handled by a normal authentication that returns a redirect result, so the switch or controller sends the HTTP session to the ISE BYOD portal while the device keeps its original SSID. The portal runs the registration, and the provisioning step drops a native supplicant profile plus a certificate from the internal CA on the machine; the next association is an EAP-TLS exchange that replaces the temporary credentials. That one-network path is exactly what the requirement asks for. The dual-SSID approach fails because it moves registration to a separate onboarding network, breaking the single-SSID constraint. Credential reuse with a directory password never delivers certificate-based return access, so the device would keep depending on the user's secret. The MAB-plus-posture route is an access-control strategy, not a BYOD onboarding flow: profiling cannot issue a certificate, and posture gates rights rather than registering the device. Exam caveat: single-SSID onboarding does require the redirect ACL to let the portal and provisioning services through before authorization. Practical check: watch a test laptop through both associations and confirm the second one shows EAP-TLS with the issued identity.