A logistics company is branding its guest Wi-Fi. Visitors must open https://guest.northwind.example to self-register, the sponsor approval email links to that same address, and the browser must show a trusted certificate with no name warning. Security policy prohibits wildcard certificates. Today the portal is served with a node certificate that lists only ise01.corp.example. Which certificate and DNS preparation must be completed before the portal goes live?
Select an answer to reveal the explanation.
Short Explanation
You’re checking two things when a guest opens the portal: the name matches the address, and the certificate chain is trusted. Publishing the portal name in DNS and using a certificate with that exact name in its SAN and a chain trusted by guests’ browsers addresses both requirements. A wildcard is ruled out by policy, and pointing sponsor links at a different hostname breaks the shared address.
Full Explanation
The correct preparation is to publish the requested guest hostname in DNS and install a portal certificate that names guest.northwind.example in its SAN and chains to an issuer trusted by visitors’ browsers. DNS directs the requested URL to the portal; the SAN match prevents a hostname warning, and browser trust depends on a valid chain to a trusted root. A wildcard certificate for *.northwind.example is supported by ISE and browsers would accept it for this hostname, but the stated security policy prohibits wildcard certificates, so relying on one fails the requirement. Pointing sponsor approval emails to ise01.corp.example leaves those links using a different address from the required guest URL; the guest portal may work, but the sponsor flow does not meet the shared-address requirement. Installing a trusted leaf certificate with the exact SAN but omitting its intermediate can leave browsers unable to build a trusted chain, so trust is not reliably established. Exam caveat: some browsers can retrieve missing intermediates or have them cached, which can mask an incomplete-chain deployment; do not treat that behavior as a substitute for serving the chain correctly. Practical check: test the guest URL and a real sponsor email link from a clean browser, confirming both resolve to the intended portal and show the exact hostname with a valid, complete certificate chain.