A design agency with 600 personal phones and tablets allows BYOD on the corporate WLAN. Staff open the BYOD portal from the guest page, accept the usage terms, and register the device; every certificate must come from ISE's internal CA and arrive through the self-service flow, and each device must authenticate with its own certificate rather than the employee's directory password. Which BYOD component sequence delivers that certificate?
Select an answer to reveal the explanation.
Short Explanation
Your phone walks three steps: register at the portal, get signed by the internal CA, then install the profile the portal hands over. The device proves its own identity instead of borrowing the employee's password. It's the difference between a named key and one shared office code.
Full Explanation
The required sequence pairs certificate issuance by ISE’s internal CA with delivery through the self-service provisioning portal. That portal provides the device with the matching supplicant profile, enabling WLAN authentication using the device certificate rather than the employee’s directory password. An IT-assisted onboarding service could use the correct internal CA and install a suitable profile, but it substitutes assisted enrollment for the required self-service flow. An enterprise or corporate PKI can commonly issue device certificates and work with a self-service portal, but it does not meet the explicit requirement that ISE’s internal CA issue every certificate. A PEAP profile can be deployed through self-service, and the internal CA can issue a device certificate, but PEAP authenticates using credentials rather than the device certificate; issuing a certificate alone does not make it the authentication credential. Exam caveat: distinguish who issues the certificate from which enrollment component delivers it, and verify the configured EAP method rather than inferring it from certificate issuance. Practical check: inspect the ISE BYOD portal and certificate authority settings, then confirm the installed profile uses certificate-based EAP and presents the device certificate during a test WLAN authentication.