A university enables BYOD on the campus wireless network and on wired dormitory ports. Endpoints must be redirected to the ISE onboarding portal before they gain access, and during registration they must get an address, reach DNS, the ISE portals and an internal issuing CA on a separate subnet to install their certificate. Everything else stays blocked until onboarding finishes. Which pre-auth ACL content allows registration while keeping the port locked down?
Select an answer to reveal the explanation.
Short Explanation
A solid pre-auth ACL is the airlock that gives an unregistered device just enough room to register. DHCP and DNS reach the portal, HTTPS reaches the issuing CA on its own subnet, and you keep everything else outside until it's enrolled. Allow too much and an unenrolled laptop already has the run of the campus.
Full Explanation
The correct ACL permits the minimum services needed before onboarding: DHCP to obtain an address, DNS to resolve required names, and HTTPS to the ISE portals and separate issuing CA subnet so the endpoint can complete certificate enrollment. Its final deny keeps other traffic blocked until registration finishes, preserving the pre-authentication boundary. The NTP variant adds a commonly used time-synchronization exception, but that is still traffic beyond the stated enrollment needs; permitting it conflicts with the requirement to block everything else. The UDP-only DNS variant is a familiar restrictive ACL pattern, yet DNS can also use TCP, for example for truncated responses or large DNSSEC answers, so it does not reliably provide the required DNS access. The CA-subnet variant makes enrollment convenient by allowing every protocol to that subnet, but it exposes services and traffic beyond HTTPS and therefore fails the least-privilege lockdown requirement. Exam caveat: DHCP exchanges may involve client broadcasts and server replies, so the needed directions and ports depend on the platform and ACL enforcement point. In practice, verify the actual ISE portal and CA addresses, confirm the ACL permits the required DHCP/DNS flows and TCP 443 to those destinations on both wireless and dormitory wired access, and test that unrelated destinations remain blocked before onboarding completes.