A 400-person firm runs ISE as its only infrastructure beyond the network gear, so every certificate and profile must come from ISE itself. Staff must register their own smartphones from a web portal, have the 802.1X supplicant configured automatically for certificate-based login, and receive a device certificate while onboarding on their own. Which ISE BYOD component delivers this workflow?
Select an answer to reveal the explanation.
Short Explanation
You need one component that both writes the 802.1X settings and signs the client certificate, and only ISE is on hand to do both jobs. It's an in-house stamp: the internal CA signs the device certificate while native supplicant provisioning writes the profile. The other routes assume infrastructure this firm simply hasn't built.
Full Explanation
BYOD in ISE is a chain of three pieces: the registration portal records the device, native supplicant provisioning pushes an EAP-TLS profile onto it, and the internal CA built into ISE signs the client certificate that profile relies on. Because this firm runs only ISE, the built-in CA is the certificate authority available to it, and because the employee onboards unattended, the provisioning step has to configure the supplicant automatically once registration finishes. MDM-based onboarding fails the infrastructure fact, since there is no management platform to enrol against, even though it does configure supplicants well. Self-service enrollment against an enterprise PKI fails the same fact from the other direction, because that path assumes a customer CA and SCEP already exist. Profile-only delivery fails the certificate requirement, because it writes just the network name and passphrase and leaves certificate-based 802.1X unconfigured. Exam caveat: the artifact delivered by provisioning varies by operating system and ISE version, so reason about the workflow rather than the file type. Practical check: after onboarding, open the client certificate store and confirm the device certificate chains to the ISE internal CA.