300-715 · Question #237
An engineer needs to configure a new certificate template in the Cisco ISE Internal Certificate Authority to prevent BYOD devices from needing to re-enroll when their MAC address changes. Which…
The correct answer is B. MAC Address and GUID. When configuring a certificate template in Cisco ISE's Internal CA for BYOD, the Subject Alternative Name (SAN) must include both MAC Address and GUID. The MAC Address ties the certificate to the device, but if it changes (e.g., MAC randomization), the certificate would no…
Question
An engineer needs to configure a new certificate template in the Cisco ISE Internal Certificate Authority to prevent BYOD devices from needing to re-enroll when their MAC address changes. Which option must be selected in the Subject Alternative Name field?
Options
- ACommon Name and GUID
- BMAC Address and GUID
- CDistinguished Name
- DCommon Name
How the community answered
(66 responses)- A9% (6)
- B86% (57)
- C3% (2)
- D2% (1)
Explanation
When configuring a certificate template in Cisco ISE's Internal CA for BYOD, the Subject Alternative Name (SAN) must include both MAC Address and GUID. The MAC Address ties the certificate to the device, but if it changes (e.g., MAC randomization), the certificate would no longer match and re-enrollment would be required. The GUID (Globally Unique Identifier) provides a persistent, device-specific identifier that does not change when the MAC address changes. By including both, ISE can still recognize and validate the device via the GUID even after a MAC address change, eliminating the need for re-enrollment.
Topics
Community Discussion
No community discussion yet for this question.