A defense contractor protects its WLAN with a 9800 controller and ISE across 600 laptops. Every laptop holds a user certificate from the internal CA, policy forbids any user password for network access, and authorization must key off the signed-in person rather than the computer account. Which EAP method should be configured?
Select an answer to reveal the explanation.
Short Explanation
Set up EAP-TLS with user certificates—it’s like showing a trusted ID at the door. Your laptop and the network authenticate with certificates, so you don’t need a password, and ISE can authorize you by your user certificate rather than the computer account.
Full Explanation
EAP-TLS is the best fit because it provides certificate-based mutual authentication without requiring a network-access password. With the user's certificate presented during authentication, ISE can identify the signed-in user and apply authorization policies to that person, rather than treating the laptop's computer account as the user's identity. PEAP-MSCHAPv2 is a widely deployed password-based method: server-certificate validation protects the tunnel, but the inner exchange still requires the user's directory password, contrary to policy. Machine-certificate EAP-TLS avoids passwords and is also common, but it authenticates the laptop's computer account; that identity does not establish which person is signed in, so authorization cannot reliably key off that person. User-certificate EAP-TLS with endpoint-group or posture-based authorization retains certificate authentication and avoids passwords, but its policy decision is based on the device, not the signed-in user. Exam caveat: EAP-TLS alone does not guarantee the intended identity mapping; certificate contents, ISE identity sources, and authorization rules must align. A practical check is to test a user login and confirm ISE logs show that user's certificate identity and that the resulting authorization profile follows the user rather than the endpoint record.