A 120-person law firm lets partners use their own laptops to reach the document portal, and each laptop must pass 802.1X using a device certificate. IT requires that personal hardware stay free of MDM enrollment. Which BYOD registration approach should the firm use for the personal laptops?
Select an answer to reveal the explanation.
Short Explanation
Your personal laptops need their own identity, and the ISE BYOD registration portal can provision each one with a device certificate and connection settings without MDM enrollment. It’s like giving every device its own building pass rather than relying on the partner’s password. User certificates, directory credentials, and temporary guest credentials identify or authenticate users, not the laptop with the required device certificate.
Full Explanation
The ISE BYOD registration portal is the appropriate fit because it lets partners register personal laptops and provision them with device certificates from the internal CA for certificate-based 802.1X, without requiring MDM enrollment. The certificate is associated with the laptop, supporting device authentication while honoring the firm’s restriction on managing personal hardware. EAP-TLS with individual partner user certificates is a valid certificate-based design and avoids MDM, but its credentials identify the partner rather than the laptop, so it misses the explicit device-certificate requirement. PEAP with directory credentials is also a common way to authenticate unmanaged endpoints through 802.1X, but it authenticates users with passwords rather than presenting the required device certificate. Guest self-registration followed by temporary PEAP credentials can provide a controlled onboarding path and portal authorization, yet it likewise does not make the laptop pass 802.1X using a device certificate. An exam caveat is to distinguish user identity from device identity: both can involve certificates or 802.1X, but they are not interchangeable when the requirement specifies a device certificate. In practice, verify that registration installs a device certificate with the intended identity and trust chain, then test that the laptop completes EAP-TLS on the production network without MDM enrollment.