Which of the following authentication methods should be used for BYOD wireless devices?

Local certificates might be used as part of an EAP method with RADIUS, but "local certificates" alone is not an authentication method; rather, it's a component.

TACACS+ is primarily used for authenticating network device administration (e.g., routers, switches), not typically for authenticating user devices accessing the network.

RADIUS (Remote Authentication Dial-In User Service) is a widely used networking protocol that provides centralized authentication, authorization, and accounting (AAA) management for users connecting to a network, including wireless devices. It is well-suited for BYOD scenarios because it can integrate with existing identity stores (like Active Directory), support various EAP methods for secure authentication, and allows for granular policy enforcement based on device or user.

A captive portal is a web page that users must view and interact with before they are granted broader access to a network, often used for guest access or initial registration, but it's not the primary authentication protocol for secure BYOD integration, though it can work in conjunction with RADIUS.