A regional airline issues company tablets to cabin crew and lets staff use personal phones for email and the crew portal. Staff must enroll their own devices, access must survive restarts with no credential prompts, a single lost device must be revocable, and identity must resist MAC-address cloning. Which BYOD capability meets these requirements?
Select an answer to reveal the explanation.
Short Explanation
You can have each staff member enroll their device in the ISE self-service portal and receive a unique certificate for EAP-TLS. It’s like giving every device its own ID badge: access survives restarts without repeated prompts, and you can revoke one lost device without relying on a cloneable MAC address.
Full Explanation
A unique certificate per device, provisioned through the ISE self-service portal for EAP-TLS, provides device-specific authentication without relying on a changeable MAC address. The certificate can be stored on the device and used automatically after a restart, while revoking that device’s certificate blocks it without disrupting other staff devices. A shared EAP-TLS certificate can also support automatic authentication and resist MAC-address cloning, but it cannot identify which device presented the certificate; revoking it to address one loss affects every device using it. MAB can be configured with registered device addresses and cached authorization, and an administrator can remove a lost device’s entry, but the MAC address is observable and can be cloned, so it is not a reliable device identity. A captive portal with individual device accounts can support enrollment and per-device revocation, but requiring sign-in after each restart fails the no-credential-prompts requirement. Exam caveat: EAP-TLS only provides these benefits when certificates are unique, properly protected, and checked against current revocation status; merely using certificates does not ensure per-device revocation. Practical check: enroll a test device, confirm its certificate identity in ISE, restart it to verify prompt-free access, then revoke its certificate and confirm that other enrolled devices remain connected.