An employee wants to connect a personal phone to the corporate SSID. Security forbids a shared Wi-Fi password and wants each device to authenticate individually with credentials that can be revoked. Which Cisco ISE approach meets this?
Select an answer to reveal the explanation.
Short Explanation
A shared password is like one house key copied for the whole neighborhood: you can't take it back from just one person. BYOD onboarding gives each phone its own certificate, so you can revoke that device alone. MAB looks tidy, but it's trusting a MAC address that anybody can fake.
Full Explanation
ISE BYOD onboarding lets an employee register a personal device through a portal. ISE, through its native supplicant provisioning flow, installs a supplicant profile and enrolls a certificate for that device, often from the ISE internal certificate authority. The device then authenticates with EAP-TLS using its own certificate, bound to both the user and the device, and the device appears in the My Devices portal where it can be marked lost or revoked without affecting anyone else. A guest hotspot code is meant for visitors, provides only guest access, and gives no per-device credential tied to the employee. MAB authorizes on the MAC address alone, which is easily spoofed and provides no cryptographic proof of the device, so it fails the individual credential requirement. A PSK on a separate SSID is exactly the shared password the policy forbids, and revoking it for one device means changing it for everyone. Exam caveat: dual-SSID onboarding uses an open provisioning SSID before moving the device to the secure SSID, while single-SSID onboarding first authenticates with PEAP on the secure SSID. Operational check: confirm in ISE live logs that the phone authenticates with EAP-TLS and that its certificate appears under issued endpoint certificates.