Parks 802.1X certificate profiles fail because SCEP to the civic CA never completes. Carbon Black Cloud is healthy. What should the security administrator debug?
Select an answer to reveal the explanation.
Short Explanation
The 802.1X badge is printed by SCEP, not by Carbon Black. If the civic CA never answers, debug the path from Workspace ONE UEM to NDES.
Full Explanation
When parks 802.1X certificate profiles fail because SCEP to the civic CA never completes while Carbon Black Cloud is healthy, debug SCEP/NDES reachability from Workspace ONE UEM to the civic CA. Certificate profile delivery depends on UEM completing SCEP/NDES enrollment with the CA; CBC health does not diagnose a broken SCEP path. Restoring that reachability returns 802.1X certs to civic parks devices. Carbon Black Cloud Live Query against the CA's LSASS process fails by concept because Live Query on LSASS does not restore UEM-to-CA SCEP enrollment for Wi-Fi certificates. NSX-T T0 ECMP so SCEP packets hash to a new Edge fails by concept because changing T0 ECMP hashing does not fix UEM connector or CA SCEP configuration and reachability. Workspace ONE Access MFA bypass for the CA service account fails by concept because Access MFA bypass is unrelated to SCEP certificate enrollment from UEM. Exam caveat: failed 802.1X cert profiles with healthy CBC point to SCEP/NDES reachability from UEM to the civic CA—not CBC Live Query, T0 ECMP, or Access MFA bypass. Operational check: trace UEM/ACC connectivity to NDES/CA, fix firewall or service issues, reissue a test certificate profile, confirm 802.1X associates, and document the SCEP dependency in the parks WLAN certificate runbook for municipal wireless security.