A manufacturer is designing WPA2-Enterprise wireless for four thousand staff laptops. Every laptop already holds a user certificate from the corporate internal CA, company policy limits wireless authentication to certificates instead of passwords, and the wireless controller and ISE already present a trusted server certificate. Which EAP method should be selected for the staff WLAN?
Select an answer to reveal the explanation.
Short Explanation
You’re well set up for EAP-TLS: your laptop presents its corporate user certificate, while the WLAN proves its identity with the trusted server certificate. This meets your certificate-only policy without requiring a password.
Full Explanation
EAP-TLS is the right fit because each laptop can authenticate with the corporate internal CA user certificate it already holds, while the laptop validates the WLAN server using the server certificate the controller and ISE already present and the laptop trusts. This meets the certificate-only policy without password-based inner authentication. Machine-certificate mapping can be a valid device-authentication design, but it authenticates each laptop as a device rather than using the staff user certificates specified in the scenario. Anchoring client-certificate validation to a public CA is another possible trust model, but it requires certificates issued by that public CA, not the internal CA certificates already on the laptops. Smart-card client certificates with user PINs can also support certificate-based authentication, but they depend on smart-card credentials and a separate credential store rather than the installed certificates. Exam caveat: selecting EAP-TLS alone does not guarantee certificate-only access; verify the configured authentication requirements. Practical check: test a representative laptop end to end, confirming that ISE accepts its internal-CA user certificate and that the laptop validates the actual server certificate and identity.