A regional hospital wants staff using personal phones on the corporate WLAN. Staff must enroll their own devices themselves, with the help desk out of the loop, each phone must connect with EAP-TLS using a certificate issued during that enrollment, and the resulting access must follow the user's identity group rather than the phone's MAC address. Which ISE BYOD provisioning workflow meets all three needs?
Select an answer to reveal the explanation.
Short Explanation
You can let staff enroll their own phones through the single-page BYOD workflow, with ISE issuing the EAP-TLS certificate during enrollment and access following the user's group. That keeps the process in your staff's hands and ties authorization to identity, not the phone's MAC address.
Full Explanation
The single-page BYOD workflow meets all three requirements: staff register their own phones without help-desk involvement, ISE issues an EAP-TLS certificate during enrollment, and access follows the user's identity group. The portal workflow that assigns WLAN policy from the registered endpoint record supports self-enrollment and an enrollment-issued certificate, but its authorization is based on the device record rather than the user's group. The portal workflow using an MDM-provisioned certificate supports self-enrollment and user-group access, but the certificate is provisioned before ISE enrollment, not issued during it. The help-desk-guided workflow can issue the certificate during setup and assign access by identity group, but staff do not enroll independently because the help desk is involved. Exam caveat: BYOD enrollment, certificate issuance, and authorization policy are distinct workflow requirements; meeting two does not establish that the third is met. Practical check: test a newly enrolled phone and verify the enrollment event, the EAP-TLS certificate's source and issuance timing, and that the authorization result uses the user's identity group rather than the endpoint record or MAC address.