Workspace ONE Engineer - Extended Free Sample Questions

To support users from multiple domains within a single Active Directory forest without deploying an ACC to each child domain, administrators should enable 'Multi-Domain' in the Directory Services configuration. Furthermore, the Server URL must point to the Global Catalog port (3268 for LDAP or 3269 for LDAPS). This allows the ACC to query the Global Catalog, which contains a partial replica of all objects across all domains in the forest. Changing the bind user format or adjusting sync schedules does not resolve the cross-domain routing limitation. Deploying standalone Access Connectors does not solve UEM directory integration.

To automate the revocation of certificates issued by Microsoft ADCS when a device is Enterprise Wiped, the administrator must enable the 'Revoke Certificate on Unenroll' setting within the Certificate Authority integration configuration in the UEM console. When a wipe occurs, UEM signals the ACC, which uses its service account permissions to issue a revocation command directly to the ADCS server. Compliance policies can revoke profiles, but the automated CA-level revocation relies on the CA integration setting. VPN profiles and Freestyle Orchestrator do not natively handle this automated revocation lifecycle.

In a multi-tenant Workspace ONE UEM environment, Role-Based Access Control (RBAC) follows a strict top-down inheritance model. A custom Administrator Role created at a child Organization Group (OG) is only visible and assignable to administrators at that specific child OG and any of its subsequent sub-OGs. It cannot be pushed upwards or assigned to administrators residing at a parent OG. Therefore, the statement is False.

The Hub Services console allows administrators to highly customize the digital employee experience (DEX) within the Workspace ONE Intelligent Hub app. This includes customizing the branding (logos, colors) and defining the layout and visibility of navigational tabs such as Apps, People, and Support. VPN protocols and split-tunneling are configured via UEM Tunnel profiles, not Hub Services. Minimum OS versions are defined in UEM Enrollment Restrictions. Active Directory synchronization is managed via the ACC or Access Connector, completely independent of Hub Services.