A 300-person finance firm wants staff to use personal laptops and phones on the corporate WLAN. Each device must sign in with the employee's directory credentials, receive a device identity certificate during onboarding, land in a limited-access segment, and keep the user in full control of the device. Which BYOD use case in ISE meets all four requirements?
Select an answer to reveal the explanation.
Short Explanation
With user-led onboarding, you sign in with your directory credentials and get a device certificate plus a limited-access profile—like a visitor badge that opens only approved doors. Your personal device stays under your control, without full-device MDM enrollment.
Full Explanation
In the standard ISE BYOD flow, the user authenticates with directory credentials, a client provisioning policy can provide a native supplicant profile, and a certificate is issued to the endpoint for later certificate-based authentication such as EAP-TLS. The authorization policy can return a restricted authorization result, such as a VLAN or a security group tag, to limit network access. User-led onboarding can meet the personal-device control requirement without full-device MDM management; MDM enrollment is not inherently incompatible with user-owned devices, but the full-device management described in that distractor conflicts with this scenario. A PEAP password login satisfies the credential requirement but does not issue the required device identity certificate. An onboarding flow that finishes with full corporate LAN access does not meet the limited-access requirement. ISE can also integrate with MDM, so whether a device remains user-controlled depends on the management arrangement, not simply on whether MDM is used. After onboarding, verify the endpoint certificate and the authorization result.