300-715 Question #279: Real Exam Question with Answer & Explanation

Question

A network engineer is configuring a new certificate template on the internal CA within Cisco ISE to provision certificates to BYOD devices that must be enrolled in the network. What must be configured in the SAN field of the certificate to identify the devices after enrollment?

Options

• AMAC address
• Bemail address
• Cuser principal name
• Dcommon name

Explanation

To uniquely identify BYOD devices in Cisco ISE after enrollment, the MAC address of the device must be configured in the Subject Alternative Name (SAN) field of the certificate template issued by the internal CA.

Common mistakes.

• B. An email address is typically associated with a user, not a unique device identity for network access control purposes like BYOD device identification.
• C. A user principal name (UPN) is associated with a user identity, primarily in Active Directory, and is not a standard unique identifier for a device in the context of network access control.
• D. While the common name (CN) can identify the device, the SAN field is designed to hold multiple alternative identities, and using the MAC address specifically in the SAN is a common and recommended practice for device identification in BYOD scenarios with certificates.

Concept tested. Cisco ISE BYOD device certificate identification

Reference. https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ISE_admin_guide_27/b_ISE_admin_guide_27_chapter_0110.html#concept_F7DCCBBE1FBB427D8916361C102C30F9

No community discussion yet for this question.