Free Cisco 300-715 Practice Exam with Questions & Answers | Set: 6

EAP-GTC, or EAP Generic Token Card, supports authentication using token-based or one-time-password credentials. It can operate within a protected EAP method, such as PEAP, so that the token credentials are transmitted through an encrypted TLS tunnel. This makes it appropriate when Cisco Secure Client users authenticate against an LDAP-backed token system. MS-CHAPv2 is primarily designed for username-and-password authentication and requires password-verification capabilities that generic LDAP or token systems may not provide. LEAP is a legacy Cisco authentication method with known security weaknesses and should not be selected for a new secure deployment. EAP-MD5 provides only basic challenge-response authentication, lacks mutual authentication, and does not provide suitable protection for wireless enterprise access. Therefore, EAP-GTC is the protocol aligned with secure-token authentication through Cisco Secure Client.

When wildcard certificates are prohibited, every portal hostname that clients might access must be explicitly included in the certificate’s Subject Alternative Name extension. Modern browsers and operating systems validate the requested portal FQDN primarily against the SAN entries rather than relying only on the Common Name. The engineer should therefore add each guest, sponsor, BYOD, client-provisioning, and other applicable portal FQDN to the SAN field before submitting and signing the certificate request. A single Common Name cannot represent multiple distinct portal names reliably. DNS AAAA records merely map hostnames to IPv6 addresses and do not make those hostnames valid identities within a certificate. Creating a record for the Administration node also does not protect portal URLs unless that exact hostname is used. Explicit SAN entries provide the required hostname validation without using a wildcard.

The Bring Your Own Device portal is the onboarding portal used when employees register personal endpoints and provision native supplicants. During the BYOD workflow, Cisco ISE authenticates the employee, registers the endpoint, provisions the operating system’s native 802.1X supplicant, and can obtain an endpoint certificate from the Cisco ISE internal Certificate Authority. The resulting certificate and supplicant profile allow the device to reconnect securely to the corporate WLAN or wired network using certificate-based authentication. The Client Provisioning Portal primarily distributes software such as Cisco Secure Client and posture components. The My Devices portal allows users to view, manage, or report previously registered devices as lost, stolen, or reinstated; it is not the primary onboarding interface. “Personal Device portal” is not the appropriate Cisco ISE portal type for the native-supplicant BYOD registration and internal-CA certificate workflow described.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_27_admin_guide/b_ISE_admin_27_deployment.html#ID185