A university issues laptop certificates from its internal CA, authenticates 3,000 staff with Active Directory passwords, and runs 20 shared lab logins that exist nowhere else. Which ISE authentication configuration can serve all three groups?

The correct configuration matches each population to an authentication method and identity source that can validate it. Laptops present their university-issued certificates through EAP-TLS; ISE must have a certificate authentication profile and the required identity-resolution configuration to map each certificate to an identity. Staff authenticate with their Active Directory passwords, which AD can verify. The shared lab accounts are absent from AD, so they must be stored in the ISE internal store, where ISE can query them. The Active Directory approach for both staff and lab users fails because a certificate authority issues certificates but does not make the lab accounts exist in AD; the lab logins cannot be validated there. The internal-store-for-everyone approach misuses a local identity store for staff whose passwords are in AD and replaces laptop certificate authentication with passwords, so it does not use the issued device certificates. The familiar-credentials approach also fails for laptops: sending laptop passwords to AD is password authentication, not EAP-TLS certificate authentication, even though its lab-store choice is suitable. Exam caveat: a trusted certificate issuer alone is not sufficient; ISE also needs to resolve the certificate to an identity. Practical check: verify the laptop certificate chain and identity mapping, test a staff password against AD, and confirm a lab account exists in the ISE internal store.