A bank is adding a second data center and ships an ISE appliance straight to the colo, where no ISE administrator has console access. The site has internal DNS that resolves the existing PAN, and the new node's first-boot installation and network setup must complete with nobody touching it locally. Which zero-touch provisioning approach should the team use?
Select an answer to reveal the explanation.
Short Explanation
You can use ISE ZTP: build a configuration image holding the node's network settings and credentials, attach it so first boot runs unattended, and then register the node from the PAN. ZTP automates installation and base setup; it doesn't make a node discover and join a PAN on its own.
Full Explanation
ISE Zero Touch Provisioning (available since ISE 3.1) automates installation and initial setup without manual input. You build a configuration image (or VM user data) containing the hostname, IP address, netmask, gateway, DNS domain, name server, NTP server, time zone and admin credentials, then attach it to the node, for example as virtual media or through the UCS APIs, so the setup script runs unattended on first boot. The node then still has to be registered to the deployment from the PAN, and the PAN and node must be able to resolve each other's names, which the site's internal DNS provides. Staging at a depot contradicts the stated fact that the appliance ships straight to the colo. The idea that ZTP enabled on the PAN lets a node discover it through DHCP and DNS and join by itself is not how ISE works: ZTP supplies the node's own setup data, and registration is initiated on the PAN. Remote virtual KVM can reach the console, but an administrator then types the bootstrap values manually, which is not zero-touch provisioning. Exam caveat: ZTP settings are stored in plain text in the image, so the first GUI login forces a password change. Practical check: before shipment, validate the image settings, DNS reachability and NTP, then confirm the node comes up and can be registered from the PAN.