Exam 300-715 topic 1 question 226 discussion

Actual exam question from Cisco's 300-715

Question #: 226
Topic #: 1

To configure BYOD using Cisco ISE. an administrator is considering issuing certificates to the devices connecting to provide a better user experience. External CA servers cannot be used for this purpose because everything must be local to the Cisco ISE. What must be done to accomplish this?

A. Use the captive portal network assistant to issue certificates to the endpoints as they authenticate.
B. Use ISE as a sub CA for the BYOD portal and redirect users to the Root CA for certificate issuance.
C. Configure the Cisco ISE Internal CA to issue certificates to each endpoint connecting to the BYOD network.
D. Configure MS SCEP so that endpoints can query their local AD server for the correct certificate.

Show Suggested Answer

Suggested Answer: C 🗳️

by XBfoundX at Dec. 5, 2023, 3:31 a.m.

Comments

Submit Cancel

diverjim64

2 weeks, 6 days ago

Selected Answer: C

see XBfoundX link

upvoted 1 times

...

XBfoundX

8 months ago

PKI and ISE Internal CA Although issuing signed certificates to the endpoints for BYOD is optional, many customers will consider issuing certificates to the endpoints as it provides better security and user experience for subsequent connections. When ISE is installed the internal CA is installed and enabled by default. Here are the characteristics of ISE internal CA. - Primary Admin node is the root CA - Both primary and Secondary admin node is also Sub-CA of the root called Node_CA. This added layer of hierarchy allows single root hierarchy which simplifies the deployment when new PSNs are added while the primary node is not the active admin node

upvoted 3 times

XBfoundX

8 months ago

https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867

upvoted 1 times

...