How Are Certificates and Supplicants Deployed to Mobile Devices?
Describe identity management and secure network access concepts such as guest services, profiling, posture assessment, and BYOD
Configure network access control mechanisms such as 802.1X and MAB with Cisco Identity Services Engine
Which method is used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources?
Answer
Correct answer: A — BYOD onboarding is the ISE workflow that provisions the native supplicant and enrolls a client certificate on mobile devices before granting network access.
Community Insight
The question tests whether you know the full ISE onboarding method (registration + client provisioning + certificate enrollment), and the trap is picking a single sub-component such as SCEP or client provisioning.
Cisco ISE BYOD onboarding is the workflow that registers a mobile device, pushes a native supplicant profile, and enrolls a client certificate so the device can authenticate with 802.1X. This page confirms why BYOD onboarding, not SCEP or MAC authentication bypass, is the correct answer for certificate-plus-supplicant deployment.
Many learners choose SCEP (D) because certificates are mentioned, but SCEP is only an enrollment protocol and configures no supplicant, no SSID, and no device registration.
Community Discussion (55 comments)
John_Cho
👍 1
Selected: D
The Verified Correct Answer: D. Simple Certificate Enrollment Protocol Proof from the Cisco Exam Database: Under question #55 of the official CCNP Security SCOR practice database, the question is written verbatim : "Which method is used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources?" Correct Answer: D. Simple Certificate Enrollment Protocol Cisco's Theoretical Logic: SCEP is the method (protocol) that actually requests, delivers, and configures the certificate payload inside the native supplicant of the mobile device . Without SCEP, the device cannot securely obtain a certificate over the air .
G0909
👍 1
Selected: A
In BYOD certificate is deployed automatically for secure cert based authentication.
josmen85
👍 1
Selected: C
Explicación técnica (nivel Cisco ISE / Enterprise) En entornos de Cisco Identity Services Engine, el proceso de client provisioning es el mecanismo utilizado para: Instalar automáticamente el supplicant 802.1X Desplegar certificados digitales en el endpoint Configurar perfiles de red (EAP-TLS, PEAP, etc.) Preparar el dispositivo para autenticación segura 👉 Esto es exactamente lo que la pregunta describe: configurar supplicant + desplegar certificados en dispositivos (especialmente móviles)
ExamTopicsuser23
👍 1
Selected: C
C is the way
gaurav4101
👍 1
Selected: A
If a device supports native supplicant installation BYOD portal can be used while in other case Client provisioning portal is used.
diverjim64
👍 1
Selected: A
ISE Cert Guide, p. 487. "BYOD onboarding: this includes registering a device with ISE, provisioning the certificate to the device, and configuring the device's supplicant."
CyberGhost666
👍 1
Selected: A
I’ll go with A. Option A is the entire process of securely bringing a personal (non-corporate) device onto the network and includes: • Authenticating the user • Installing a certificate • Configuring the supplicant (like 802.1X or EAP-TLS) • Applying network access policies • It uses client provisioning as one step in the process.
Vroomp
👍 1
Selected: C
Client Provisioning is the process of enabling devices to connect to the network. BYOD is more of allowing personal devices to connect. Client provisioning is the most suitable response, given the options available.
lnoraset
👍 4
Selected: A
BYOD (Bring Your Own Device) onboarding refers to the process of securely enrolling personal mobile devices (e.g., smartphones, tablets) into a network. During onboarding, the following actions typically occur: • Certificates are deployed to the device for secure authentication. • The supplicant (software responsible for 802.1X authentication) is configured to connect to the network. • Security policies are applied to ensure proper access control and compliance. This method is widely used in environments where employees or users bring their own devices and need secure access to enterprise network resources
kloug
👍 1
Answer a
Premium_Pils
👍 1
Selected: A
Jessie and sully seems to have done a good research on the topic
ffsilveira10
👍 4
Selected: D
I would go with D. a) the question don't say nothing if the device is corporate owned or not. So BYOD it doesn't make sense. b) authentication bypass certainly is not a method to deploy certificates. c) client provisioning is not related to certificates deployment.
Marshpillowz
👍 1
Selected: A
I think A - BYOD
4pelos
👍 3
Correct answer A: When supporting personal devices on a corporate network, you must protect network services and enterprise data by authenticating and authorizing users (employees, contractors, and guests) and their devices. Cisco ISE provides the tools you need to allow employees to securely use personal devices on a corporate network. Guests can add their personal devices to the network by running the native supplicant provisioning (Network Setup Assistant), or by adding their devices to the My Devices portal. Because native supplicant profiles are not available for all devices, users can use the My Devices portal to add these devices manually; or you can configure Bring Your Own Device (BYOD) rules to register these devices. Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_ise_devices_byod.html
petestudies
👍 1
Selected: D
D for sure. I have done this.
KnackerTopf1
👍 1
Selected: C
It is not byod, since it's not explicitly stating that it's about employees own devices, but its rather just client provisioning
kylesam2017
👍 1
'D' is perhaps the right answer, after all. Simple Certificate Enrollment Protocol (SCEP): SCEP is a protocol that allows mobile devices to request and obtain digital certificates from a certificate authority (CA). The certificates can then be used for authentication and secure network access.
ums008
👍 2
Selected: C
I will go with C: based on Tuxzinator's response BYOD encompasses a broader set of activities including client provisioning. This makes Client Provisioning the more specific answer
jku2cya
👍 1
Selected: D
I thought it would be D - SCEP https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/116068-configure-product-00.html "At the heart of the BYOD solution is the network supplicant provisioning process, which seeks to distribute the requisite certificates to employee-owned devices. In order to satisfy this requirement, a Microsoft Certificate Authority (CA) can be configured in order to automate the certificate enrollment process with the SCEP."
seb008
👍 1
The answer is C client provisioning The method used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources is client provisioning
aliasger52
👍 1
Also note that question is asked about methods not protocols
Jessie45785
👍 2
Selected: A
A- is correct answer: https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId-748642240 Endpoint Onboarding When leveraging ISE for BYOD, there are few actions that the endpoint needs to perform, which includes starting the communication with proper ISE node via the BYOD portal, creating digital certificate pairs, submitting certificate signing request, and configuring network profile. Some O/S has provisions for such functions natively while others require downloading and running an application temporarily to assist with the flow. Aside from Apple mobile devices (iOS), ISE leverages Network Setup Assistant (NSA or AKA Supplicant Provisioning Wizard (SPW)) to ease the BYOD flow for the users. NSA is an application that is downloaded to the endpoint either from the ISE itself or from app store for each of the endpoint types. NSA assists the user to generate certificate pair, install signed certificate, and configure network and proxy settings on the endpoint.
gc999
👍 1
Selected: D
The question doesn't mention the device is the user owned device. If it is the user-owned device, then BYOD onboarding is the option. I choose Option D because Simple Certificate Enrollment Protocol allows devices to easily enroll for a certificate by using a URL and a shared secret to communicate with a PKI. Mobile Device Management (MDM) software commonly uses SCEP for devices by pushing a payload containing the SCEP URL and shared secret to managed devices. https://www.securew2.com/blog/simple-certificate-enrollment-protocol-scep-explained
aliasger52
👍 1
Mobile always cover under BYOD... thus answer is A
mhd96far
👍 2
do not trust chat gpt on questions like that, especially for Cisco exams, it makes a lot of mistakes
Naderelmansi
👍 1
Selected: D
D is correct: At the heart of the BYOD solution is the network supplicant provisioning process, which seeks to distribute the requisite certificates to employee-owned devices. In order to satisfy this requirement, a Microsoft Certificate Authority (CA) can be configured in order to automate the certificate enrollment process with the SCEP. https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/116068-configure-product-00.html
loser4fun
👍 1
Answer is C The method used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources is client provisioning. Client provisioning is a process where network administrators deploy certificates and configure the supplicant on mobile devices to allow access to network resources. This process involves configuring security policies, installing security certificates, configuring the wireless settings, and verifying the configuration of the mobile device. BYOD onboarding refers to the process of enrolling personal mobile devices into an enterprise network. MAC authentication bypass is a process that allows clients to connect to a network without authentication by whitelisting the client's MAC address. Simple Certificate Enrollment Protocol (SCEP) is a protocol used to manage and distribute digital certificates.
Tuxzinator
👍 13
Selected: C
C. The method used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources is C) client provisioning. Client provisioning is a process of deploying network settings, certificates, and other configuration information to mobile devices to enable them to securely connect to a network. This process involves configuring the supplicant, which is the client software that communicates with the network, to use the appropriate authentication methods and credentials required to access network resources. BYOD onboarding is a process that enables personal devices to connect to a corporate network, and it may include client provisioning as one of its steps. MAC authentication bypass is a method of granting network access based on the device's MAC address, without requiring any authentication credentials. Simple Certificate Enrollment Protocol (SCEP) is a protocol used for certificate management, but it is not specifically related to configuring the supplicant or deploying network settings to mobile devices.
Pierre_Bouvier
👍 2
C. Client provisioning (Partially correct but not the best) Client provisioning is a sub-process of BYOD onboarding that can push certificates and configure supplicants. However, in Cisco Identity Services Engine (ISE), client provisioning is more commonly associated with AnyConnect VPN clients and posture assessments, not full BYOD onboarding. It does not necessarily handle all aspects of certificate enrollment like SCEP does within the BYOD process.
nseguy
👍 3
Thank you, ChatGPT?
sull3y
👍 5
A. BYOD onboarding (Bring Your Own Device Onboarding) is a method used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources. This method allows employees to use their personal devices to connect to the corporate network, while ensuring that the devices meet certain security requirements. The process typically involves installing a certificate on the device, configuring the device's supplicant, and enrolling the device into a mobile device management (MDM) solution. This allows IT departments to manage and secure employee's devices while they are connected to the corporate network.
psuoh
👍 1
A sounds like the Cisco's choice as correct answer.
GatPat
👍 1
Selected: D
The question says "Method" and not a "process". A refers to a process. Simple Certificate Enrollment Protocol (SCEP) is a protocol that is used to issue and manage digital certificates, typically for use in authentication and encryption. SCEP is designed to be a simple, lightweight protocol that can be used in a variety of environments, including mobile devices and embedded systems. It is often used in conjunction with MDM solutions, which can be used to deploy the necessary root CA certificates and configure the SCEP settings on the device.
francojaraba
👍 2
Selected: A
Answer is A - "The BYOD deployment flows that support personal devices vary slightly based on these factors: Single or dual SSID: With single SSID, the same Wireless Local Area Network (WLAN) is used for certificate enrollment, provisioning, and network access. In a dual SSID deployment, there are two SSIDs.One provides enrollment and provisioning, and the other provides secure network access" Source: https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_byod.html
NikoNiko
👍 1
A and C are correct. As I understand it, BYOD ONBOARDING is more general term, which incorporates CLIENT PROVISIONING (method?) responsible for supplicant and certificate deployment. We can only guess what answer does Cisco expect. This is (again) totally stupid question as 2 answers are correct. Explanation in comments below:
NikoNiko
👍 1
C --> "Create Client-Provisioning Policy Rules for Apple iOS, Android, and MAC OS X Devices Client provisioning resource policies determine which users receive which version (or versions) of resources (agents, agent compliance modules, and agent customization packages/profiles) from Cisco ISE upon login and user session initiation." "CA Service Policy Reference This section provides reference information for the authorization and client provisioning policy rules that you must create before you can enable the Cisco ISE CA service. Client-Provisioning Policy Rules for Certificate Services This section lists the client provisioning policy rules that you must create while using the Cisco ISE certificate services. The following table provides the details [see link]." https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_basic_setup.html?bookSearch=true#concept_8B6D9760C14344EC972B2DD81876328B
NikoNiko
👍 2
A --> "BYOD may [be] simple as allowing personal endpoints connect to the network without automated onboarding process. Which assumes the end user is responsible for configuration of the endpoint to connect and gain network access. For many organizations, this level of BYOD may meet their requirement. However, the benefit of ISE BYOD flow is that ISE can assist the end user to onboard their endpoints by provisioning CA signed endpoint certificate as well as configure the network interface and OS native supplicant to utilize the provisioned certificate for network access." https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867
getafix
👍 3
Selected: A
At the heart of the BYOD solution is the network supplicant provisioning process, which seeks to distribute the requisite certificates to employee-owned devices. In order to satisfy this requirement, a Microsoft Certificate Authority (CA) can be configured in order to automate the certificate enrollment process with the SCEP. From the above we see that we use BYOD (the method) in conjunction with SCEP (the protocol) to onboard the end user mobile devices. SCEP is merely a protocol whereas BYOD is what onboards the devices using SCEP
breezer
👍 3
D is correct: At the heart of the BYOD solution is the network supplicant provisioning process, which seeks to distribute the requisite certificates to employee-owned devices. In order to satisfy this requirement, a Microsoft Certificate Authority (CA) can be configured in order to automate the certificate enrollment process with the SCEP. https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/116068-configure-product-00.html
mecacig953
👍 4
Selected: A
Definitely A Supplicant in the question disqualifies D
Iarn
👍 1
BYOD can be a method you use when no Supplicant is available though I think it has to be D
Kyle1776
👍 1
BYOD Onboarding I've been back and forth on this one but this closed the case for me. Easiest deployment method. No configuration is necessary. ISE is already enabled with Self-signed CA to use with BYOD endpoints If there is existing PKI, ISE internal CA provides distinction between enterprise CA issued certificates for managed devices, vs. BYOD https://community.cisco.com/t5/security-documents/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867
andregor
👍 3
Correct answer is D: Simple Certificate Enrollment Protocol The process of authenticating a CA server, generating a public-private key pair, requesting an identity certificate, and then verifying and implementing the identity certificate can take several steps. Cisco, in association with a few other vendors, developed the Simple Certificate Enrollment Protocol (SCEP), which can automate most of the process for requesting and installing an identity certificate. Although it is not an open standard, it is supported by most Cisco devices and makes getting and installing both root and identity certificates convenient. (CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide page #99)
NikoNiko
👍 2
D is NOT correct for sure, as SCEP relates only to certificate provisioning, but question requires also Supplicant deployment.
brownbear505
👍 1
Selected: A
Cisco Identity Services Engine Administrator Guide, Release 2.4 - Personal Devices on a Corporate Network (BYOD) [Cisco Identity Services Engine] - Cisco
andrewj511
👍 4
Correct answer is A: Background Information One of the benefits of the Cisco ISE-enabled BYOD implementation is the ability of the end users to perform self-service device registration. This eliminates the administrative burden on IT in order to distribute authentication credentials and enable devices on the network. At the heart of the BYOD solution is the network supplicant provisioning process...
jmosilva
👍 3
Correct is A (SCEP is used in enroll/deploy but does not configure the supplicant)
Reece_S
👍 2
Been trying to wrap my head around why the answer not A but i think it is D. During Onboarding keys are created and submitted but they still need to go to a CA, whether it be the ISE or external CA. if an external CA is used, its via SCEP I also found some links: https://community.cisco.com/t5/security-documents/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId-748642240 https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/116068-configure-product-00.html
Reece_S
👍 2
I'm changing my answer back to A. Devices with native supplicants can be deployed and configured by BYOD portal. I totally missed the word Supplicant in that question.
aaInman
👍 1
The problem with "A" is BYOD excludes corporate-owned devices and the questions doesn't exclude corporate-owned devices. "D" might be the right answer based on this: What is SCEP? Simple Certificate Enrollment Protocol, or SCEP, is a protocol that allows devices to easily enroll for a certificate by using a URL and a shared secret to communicate with a PKI. Mobile Device Management (MDM) software commonly uses SCEP for devices by pushing a payload containing the SCEP URL and shared secret to managed devices. This can save an administrator a lot of time and effort compared to the alternative of manually enrolling their managed devices for certificates.
itisfakemaillol
👍 4
A. BYOD onboarding
ferari
👍 3
D seems correct https://support.google.com/a/answer/9366164?hl=en
Seawanderer
👍 3
This is a Cisco exam
Raajaa
👍 4
A sounds correct
karmaomar
👍 24
correct answer is A. BYOD onboarding
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
BYOD onboarding is the end-to-end Cisco ISE workflow that takes an unknown personal smartphone or tablet, registers it through the self-service portal, applies a client provisioning policy that pushes the native supplicant profile (SSID, EAP method, trusted CA chain), and then issues the device a client certificate for EAP-TLS. Because the certificate and the supplicant settings are both delivered inside this single onboarding flow, it is the only option that satisfies both halves of the question. As andrewj511 puts it, "At the heart of the BYOD solution is the network supplicant provisioning process." The onboarding method is also what enforces posture and authorization conditions afterwards, which is why the devices can be trusted to reach protected network resources.
Why the Other Options Are Wrong
MAC authentication bypass (B) identifies a device by its MAC address and requires no supplicant and no certificate, so it cannot deploy either. Client provisioning (C) is a real ISE policy, but it is a step inside onboarding that supplies the supplicant profile and CA information rather than the complete method that also registers the device and issues the identity certificate. SCEP (D) is only an enrollment protocol for transporting a certificate request to a CA; on its own it never touches the supplicant profile or the SSID configuration. ffsilveira10 argued the question never says the device is personally owned, but ISE's onboarding terminology is the vendor's named answer for exactly this provisioning scenario, and the certificate cannot be installed for 802.1X without the supplicant being configured alongside it.
Community Comment Notes
Most learners land on the same option: karmaomar states flatly that the answer is BYOD onboarding, and itisfakemaillol, Raajaa and 4pelos agree, with 4pelos pointing to ISE's tools for letting employees securely use personal devices on the corporate network. Tuxzinator's write-up for client provisioning is a useful description of the sub-process — "Client provisioning is a process of deploying network settings, certificates" — but it describes a component of onboarding rather than the overall method the question asks for. mecacig953 captures the fastest elimination rule: "Supplicant in the question disqualifies D", since SCEP is certificate-only. A minority backs SCEP on the theory that certificate deployment equals enrollment, but the supplicant requirement in the stem defeats that reading.
Official Reference
Exam Strategy
When a question pairs two deliverables (certificate + supplicant, or profile + posture), reject answers that cover only one of them and look for the umbrella workflow name. In Cisco ISE questions, the umbrella is usually the onboarding or provisioning policy, while protocols such as SCEP, RADIUS or EAP are just mechanisms used inside it.
Frequently Asked Questions
Why isn't SCEP (D) the answer if certificates are involved?
SCEP only carries the certificate request to a CA; it does not register the device or configure the native supplicant, SSID, and EAP settings that onboarding delivers.
What does ISE client provisioning push to an iOS or Android device?
It delivers the native supplicant profile (SSID, EAP-TLS/PEAP settings) and trusted CA chain, which is why it is a step within BYOD onboarding rather than the whole method.