The provided answer is correct

As per the https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867, it should be B. CN is populated with username. SAN can only have MAC address.

Selected Answer: B It should be B. When configuring certificates for Bring Your Own Device (BYOD), it is important to consider filling the CN (Common Name) field with the endpoint host name. The CN field should contain the host name or FQDN (Fully Qualified Domain Name) of the endpoint device. This lets the certificate be properly validated when the device connects to the network. The CN field helps make sure the device is correctly identified and authorized for network access.

Selected Answer: D CN is locked to $username$ SAN is locked to either MAC or MAC+GUID. Android devices do in fact use EST for cert enrollment, so i think D is correct.

Selected Answer: C Correct answer is C. This question is very specific: "BYOD with Certificates" When Cisco ISE is set to use certificates for BYOD authentication, the endpoint must have a valid certificate.

So A is the right answer. C is not right. Certificates are not mandatory. You can also use a preshared key or username password combination.

Selected Answer: B A is wrong. SAN can have MAC address, not Username Must Be B

WHat about D? https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/116068-configure-product-00.html I am thinking D. Android uses EST and other OS uses SCEP

Selected Answer: B I vote for B.

The answer here is B. The CN field has the FQDN of the local computer, hostname + domain. The D answer is not bad but it says that Android uses EST for certificate enrollment while the other vendors use SCEP. I mean IT CAN BE USED, BUT IS NOT MANDATORY; other vendors will use different protocols also for certificate enrollments. The B answer should be true because actually the CN field contains the hostname of the device.

Selected Answer: B For device certificates in BYOD, it's common to populate the Common Name (CN) with the device host name. This helps identify and track the device on the network. Cisco ISE commonly uses this format during certificate enrollment.

Correct answer might be A or C. Device Encrollment CSR is: SAN = Username CN = Device-UDID User CSR is: SAN = MAC Address CN = Username Any thoughts on which is better?

MacOS and Windows devices: Employee clicks Register in the BYOD portal to download and install the supplicant provisioning wizard (Network Setup Assistant), which configures the supplicant and provides the certificate (if necessary) used for EAP-TLS certificate-based authentication. The issued certificate is embedded with the device's MAC address and employee's username.

Selected Answer: B i would go with B, "CN is auto populated with the username that is going through the BYOD flow. Other attributes can be entered here to reflect the site. If differentiating different endpoint or users based on certificate is needed, then any of the attributes here can be changed and can be used during AuthZ to provide differentiated access. For instance if OU=HR, the endpoint can have access to HR resources, while other endpoints cannot access HR resources" https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867

Alternative Name (SAN) Currently, only value available is the MAC Address. The MAC Address is pulled from the RADIUS session from the endpoint that initiated the BYOD flow. This is one way ISE lets admin users tie the certificate to the actual endpoint that it was signed for.

Windows for example also has this protocol: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/446a0fca-7f27-4436-965d-191635518466

The Common Name (CN), also known as the Fully Qualified Domain Name (FQDN), is the characteristic value within a Distinguished Name (DN). Usually, it is made up of the Host Domain Name and looks like, "www.digicert.com" or "digicert.com"

remember that the host domain name is the hostname of that device. For example if the name of your computer is PIPPO and you join the AD cisco.com the FQDN / CN will be PIPPO.cisco.com

According to CiscoPress SISE ebook, BYOD: --- For Android: "The NSP portal displays the device registration page with the Device ID field prepopulated with the MAC address of the endpoint." - you can also see this in the video at time 4:20: https://youtu.be/z0sRiffVdpg?t=264 - For Apple iOS, there are 2 certificates in the BYOD flow: 1. Device Enrollment ■ CN=device-UDID ■ SAN=MAC-Address --- 2. Device Provisioning ■ CN=Username ■ SAN=MAC-Address --- UDID is NOT hostname, just some numeric value and exists only for Apple. UDID according to Cisco is: "UDID Value. Match based on Unique Device Identifier (Apple specific)" https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867 - Example of UDID (it is just number): https://messapps.com/allcategories/development/finding-ios-devices-udid-via-itunes-2/ --- (continuation in comment)

Even though CN can be MAC address (Device ID) in case of Android, this is NOT true for Apple iOS. So B (hostname in CN) is NOT correct according to me. See issued BYOD certificates here (screenshot in the section Manage issued certificates): https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId-2093653871 --- Endpoint certificate is NOT mandatory for BYOD. "While ISE supports various EAP types for 802.1X authentication, with ISE BYOD, there are three EAP Types that can be used; EAP-TLS, EAP-PEAP-MSCHAPv2, and EAP-FAST" https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867 --- (continuation in comment)

So correct will be D: "In ISE 2.2 (when using the Network Setup Assistant app version 2.2.X and Android version 6.0, 7.0 or newer) during the onboarding process, the Android device will make a certificate request directly to the ISE-server using the Enrollment over Secure Transport (EST) protocol. Due to this change, the firewall port that has to be open between the Android device and the ISE-server has changed as well to port TCP 8084." https://www.wiresandwi.fi/blog/android-byod-ise-22-changes I haven't found any mention of EST support on iOS, just SCEP.

Selected Answer: B actually B and D are correct

Agree. I just tested this in a lab, and cert configuration (and adding it to a wireless profile under the Cisco-ISE-NSP provisioning resources) is required. B and D also seem correct, but I think they're looking for a "cert centric" answer here because of the question wording.

Selected Answer: C see my response to Cachaman below.