CSR submission in ISE BYOD: provisioning portal plus internal CA

300-715 By islever Editorial Last updated

Configure BYOD device on-boarding using internal CA with Cisco switches and Cisco wireless LAN controllers Configure certificates for BYOD

Short answer

AC Enable the ISE internal CA service and configure the certificate provisioning portal so end devices can submit CSRs for BYOD certificate enrollment.

Question

A network engineer must configure BYOD using Cisco ISE. In the deployment, the users must be able to submit CSR through the end devices as part of the certificate enrollment process. Which two features must be enabled to meet the requirement? (Choose two.)
  1. A certificate provisioning portal must be configured. Correct Answer
  2. Define a certificate group tag.
  3. Cisco ISE internal CA service must be enabled. Correct Answer
  4. A new BYOD portal must be created.
  5. Add SuperAdmin account into portal admin group.

Key Takeaways

This tests which ISE component actually carries a CSR from the device — the certificate provisioning portal with an enabled internal CA — versus the BYOD/Hotspot portal that only installs an identity profile.

To let end users submit CSRs during Cisco ISE BYOD enrollment, both the certificate provisioning portal and the ISE internal CA service must be enabled (A, C). The certificate provisioning portal handles CSR submission from the endpoint, while the internal CA signs the resulting certificate.

Common mistake: Option D (a new BYOD portal) is the most tempting wrong pick: the BYOD portal runs the onboarding workflow, but it never collects a device-generated CSR; CSR exchange belongs to the certificate provisioning portal.

Expert Analysis

The boundary: which portal carries a CSR The trap in this question is the difference between the Certificate Provisioning Portal (option A) and the BYOD portal used for native supplicant on-boarding (option D). The BYOD/Hotspot portal is the enrolment workflow itself — it walks the user through installing the SSID, trusting the CA and downloading a profile, typically via the Network Setup Assistant or Apple OTA. In that flow the device never generates a key pair or signs anything; it simply installs an identity profile. The Certificate Provisioning Portal is a separate ISE service whose whole purpose is to let an endpoint submit a CSR so that ISE can sign a certificate for that specific device. Because the requirement says the users must submit the CSR from the end devices, the scenario sits squarely on the Certificate Provisioning Portal side — so A is correct and D is wrong.

Why the internal CA is also required A CSR is only useful if something signs it. If ISE is configured to use an external CA or a manually installed identity certificate, there is no CSR exchange at all. Enabling the ISE internal CA service (option C) is what makes ISE able to receive the submitted CSR and issue the device certificate, which is exactly the "on-boarding using internal CA" path in the BYOD objectives. So C is correct.

Why the other options fail B, the certificate group tag, is used to select which certificate a device receives from a pool — it does not create the CSR mechanism. E, adding a SuperAdmin account to the portal admin group, is unrelated administration of portal permissions, not certificate enrolment.

The votes split between AC and CD, but the CSR-submission wording points to the provisioning portal, not the enrolment portal: the answer is A and C.

Exam Strategy

When a question names a specific request type such as a CSR, key pair or device-issued request, look for the ISE component that terminates that request rather than the component that runs the user-facing workflow. Map each portal to its job: BYOD/Hotspot portal = enrolment and profile installation, certificate provisioning portal = CSR submission and certificate issuance. Then pair it with the authority that signs — the internal CA — and treat group tags or admin accounts as selection/administrative details, not mechanisms.

Frequently Asked Questions

What is the difference between the ISE certificate provisioning portal and the BYOD portal?

The certificate provisioning portal lets an endpoint generate a key pair and submit a CSR for ISE to sign. The BYOD portal only runs the onboarding workflow that installs the network and identity profile on the device; no CSR is submitted through it.

Why must the ISE internal CA service be enabled for CSR-based BYOD enrollment?

If ISE uses an external CA or a pre-installed identity certificate, there is no CSR exchange. Enabling the internal CA lets ISE receive the endpoint's CSR and issue the device certificate during enrollment.

Does a certificate group tag let users submit a CSR?

No. A certificate group tag is a selection label that tells ISE which certificate from a certificate group to assign. It has no role in receiving or signing a CSR.

More 300-715 FAQ →

Community Votes

C
50%
A
25%
D
25%

50% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. ArchyinVa 👍 1
    The correct choices are A and C: A. A certificate provisioning portal must be configured. C. Cisco ISE internal CA service must be enabled. ### Explanation #### 1. Why Certificate Provisioning Portal (A) instead of BYOD Portal (D)? In a standard BYOD Portal flow (Native Supplicant Provisioning via the Network Setup Assistant / NSA or Apple OTA), the supplicant/device automatically handles key-pair generation and SCEP enrollment behind the scenes. End users do not manually upload or submit a Certificate Signing Request (CSR). The Certificate Provisioning Portal is specifically built to allow users (or administrators) to manually request and enroll certificates. It provides explicit UI options to: 1. Generate a single certificate with a Certificate Signing Request (CSR). 2. Generate a single certificate without a CSR (ISE creates the private key). 3. Generate bulk certificates via CSV. #### 2. Why Cisco ISE Internal CA Service (C)? To process incoming CSRs and sign/issue certificates locally directly from ISE without requiring an external CA/SCEP server, the ISE Internal Certificate Authority (CA) service must be enabled under Administration > System > Certificates > Certificate Authority > Internal CA. ### Why the other options are incorrect: B (Define a certificate group tag): Certificate group tags associate specific server certificates with portal bindings for TLS negotiation, but defining one does not fulfill the requirement of end-user CSR submission. D (A new BYOD portal must be created): While BYOD portals facilitate automatic device onboarding, they do not present the interface for users to manually submit raw CSRs. E (Add SuperAdmin account into portal admin group): While portal administrators or SuperAdmins can manage and issue certificates on behalf of others, adding a SuperAdmin is not a prerequisite feature for end-users to submit their own CSRs.
  2. Cname 👍 1
    C) Because Cisco ISE Internal CA issues the certificates after the endpoint generates and submits a CSR (Certificate Signing Request). D) A BYOD portal provides the onboarding workflow where users register their devices and submit the CSR as part of certificate enrollment.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

RADIUS CoA Configuration for Multiple Sessions

S-grade

What WebAuth Type is Used for AUP Acceptance and MAC Registration?

S-grade

Which WLC Profiling Mechanism Sends Device Data to Cisco ISE?

S-grade

Which Cisco ISE Module Contains OPSWAT Attributes?

S-grade

← Back to 300-715 Study Guide