A 300-user insurance firm joins Windows laptops to corp.local for group-based access, keeps ten macOS engineering workstations only in its OpenLDAP directory, and runs forty access switches that must keep authenticating to ISE with EAP-TLS device certificates through quarterly AD maintenance. Administrators signing into ISE also need a second factor. Which combination of identity stores and administrator authentication meets all four requirements?
Select an answer to reveal the explanation.
Short Explanation
Match each group to where its identity lives: AD for your domain-joined Windows laptops and LDAP for your Macs. Certificate profiles let ISE authenticate the switches with their device certificates through AD maintenance, while MFA adds a second factor for administrator sign-ins—like an extra lock on the admin door.
Full Explanation
The correct combination assigns each population to the store or authentication method that fits its stated needs: Active Directory supports group-based access for the domain-joined Windows laptops, LDAP serves the macOS workstations held only in OpenLDAP, certificate profiles support the switches’ EAP-TLS device authentication through quarterly AD maintenance, and MFA adds a second factor for ISE administrators. Using AD for both laptops and macOS workstation access fails because the engineering workstations exist only in OpenLDAP, so AD cannot serve as their identity store as proposed. Using PEAP-MSCHAPv2 for switch authentication fails because it is not EAP-TLS with device certificates and does not meet the switches’ stated certificate-based requirement. Using AD passwords for ISE administrators preserves the endpoint stores and switch certificates but provides only a password, not the required second factor. Exam caveat: a certificate-based method is not automatically EAP-TLS; verify that the protocol and certificate use are explicitly configured for the network devices. Practical check: review ISE identity-store sequences, the switch authentication policy and certificate profiles, and the administrator login policy, then test each population and an administrator account before rollout.