A 200-person software firm wants personal laptops on the secure WLAN using EAP-TLS instead of a shared key. Staff can self-serve through a portal, but IT has refused to install software or certificates by hand on every laptop. Which BYOD enrollment path gives each user a certificate-based 802.1X identity with the least manual work?
Select an answer to reveal the explanation.
Short Explanation
The portal does the heavy lifting: it registers the laptop and asks the internal CA to sign a certificate the operating system can use for EAP-TLS. Nothing from IT has to touch the device, which is the whole point of self-service onboarding. It's a check-in kiosk that prints your own room key instead of waiting for the manager.
Full Explanation
The portal-based ISE internal-CA path directly fits the self-service requirement: a user completes BYOD registration, and ISE issues a certificate that can identify that user for EAP-TLS without IT manually installing certificates on individual laptops. AD CS auto-enrollment with Group Policy is a standard, low-touch approach for managed Windows endpoints, but it depends on domain membership and Group Policy processing; personal BYOD laptops are not necessarily joined to the firm’s domain, so this path does not reliably enroll the stated devices. A self-service enterprise-CA portal issuing PKCS#12 files is also a real deployment pattern, but users must import the certificate and configure the Wi-Fi profile themselves, adding per-device work rather than minimizing it through portal-driven enrollment. PEAP-MSCHAPv2 is a common 802.1X method that can authenticate users with directory credentials, but it is not EAP-TLS and does not provide the required certificate-based client identity. Exam caveat: distinguish certificate issuance from certificate delivery and profile configuration; an internal CA alone does not guarantee fully automated onboarding. Practical check: test a representative personal laptop end to end, verifying that it trusts the issuing CA, receives the intended certificate and EAP-TLS profile, and maps the certificate identity to the correct ISE authorization policy.