A municipal office must let staff self-register personal laptops on the corporate WLAN. The building contract allows only one SSID per floor, and policy requires every BYOD device to hold a certificate from the internal CA before it can reach file shares. Which BYOD registration flow meets all three requirements?
Select an answer to reveal the explanation.
Short Explanation
With only one WLAN available, you need onboarding to happen on the network you’re already using. The single-SSID flow redirects your laptop to the ISE self-service portal, where you can register and obtain an internal-CA certificate before file-share access is allowed. It’s like showing ID at the desk and getting your own key card issued on the spot.
Full Explanation
The suitable flow uses the floor’s sole SSID for onboarding, redirects staff to the ISE self-service portal for registration, and provides an internal-CA certificate. That certificate can then serve as the required credential before the laptop is authorized to reach file shares. The flow that self-enrolls through ISE but obtains a device certificate from the cloud MDM provider’s CA meets the single-SSID and self-service requirements, but not the required trust source: a certificate’s presence alone does not satisfy a policy specifying the internal CA. The IT-managed EAP-TLS enrollment workflow uses the correct SSID and internal CA, but it does not let staff self-register their personal laptops. The flow that grants file-share access before issuing the internal-CA certificate reverses the required security gate, even though it uses ISE and self-registration. Exam caveat: distinguish the certificate issuer from the enrollment portal; the portal may orchestrate issuance without being the CA. Practical check: verify that the issued certificate’s chain terminates at the internal CA and that file-share authorization is denied until the device presents that certificate.