Free OCA-W sample questions

Correct answer: Create a top-level OG for global settings with three child OGs (Americas, EMEA, APAC). Create the global security profiles managed by the top-level OG and assign them to all devices, and scope each regional admin to their own child OG, where the global profiles are read-only.

Create the global security profiles at the top-level OG (Managed By = top-level OG) and assign them to all devices below it. Regional administrators whose roles are scoped to their child OG see these profiles as read-only ('this profile is being managed at a higher organization group and cannot be edited'). They can still create and assign their own Wi-Fi profiles and apps, managed at their own child OG, and those reach only that branch. Sibling OGs stay isolated from each other.

Correct answer: A SCEP payload that references the integrated Certificate Authority and its certificate template, selected as the Wi-Fi payload's Identity Certificate.

A unique per-device certificate is delivered by adding a SCEP (or Credentials) payload whose Credential Source is Defined Certificate Authority, selecting the integrated Microsoft CA and its certificate template. In the Wi-Fi payload, choose an enterprise security type (for example WPA/WPA2 Enterprise with EAP-TLS) and select that certificate as the Identity Certificate. A Credentials payload containing only the CA root certificate provides trust, not a unique client certificate.

Correct answers: A Script action (PowerShell) placed before the application step to set the required registry key.; An application action that installs the MSI package.; A second Script action placed after the application step to apply the license file (post-installation).

Freestyle Orchestrator workflows sequence resources that are already in inventory: applications, profiles and scripts. Scripts need Advanced, Enterprise or Desktop Essentials. Here, a script action sets the registry key, an application action installs the MSI (deployed through Software Distribution), and a second script action after the install applies the license file. Steps run in order, and each step must finish before the next starts. Compliance policies are not workflow steps, and a device profile does not perform these installation tasks.

Freestyle Orchestrator workflows sequence resources that are already in inventory: applications, profiles and scripts. Scripts need Advanced, Enterprise or Desktop Essentials. Here, a script action sets the registry key, an application action installs the MSI (deployed through Software Distribution), and a second script action after the install applies the license file. Steps run in order, and each step must finish before the next starts. Compliance policies are not workflow steps, and a device profile does not perform these installation tasks.

Freestyle Orchestrator workflows sequence resources that are already in inventory: applications, profiles and scripts. Scripts need Advanced, Enterprise or Desktop Essentials. Here, a script action sets the registry key, an application action installs the MSI (deployed through Software Distribution), and a second script action after the install applies the license file. Steps run in order, and each step must finish before the next starts. Compliance policies are not workflow steps, and a device profile does not perform these installation tasks.

Correct answer: The Workspace ONE UEM API connection settings within Omnissa Access are incorrect or the credentials have expired.

Omnissa Access checks compliance by calling Workspace ONE UEM through the Device Compliance (with Workspace ONE UEM) authentication method, which is pre-populated with the UEM console URL, the UEM Admin API key and the AirWatch Cloud Connector certificate. Omnissa documents that this method does not work when Workspace ONE UEM is unreachable, and that if the UEM service details change the UEM configuration in Omnissa Access must be updated, otherwise the method might fail. A broken or outdated API connection therefore makes the compliance check fail even though UEM itself shows the device as compliant.

Correct answer: Enroll the Zebra devices in Android Enterprise Fully Managed mode using a StageNow barcode and a multi-user staging account (Android Shared Device Mode = Launcher), and use Workspace ONE Launcher with check-in/check-out and an app set limited to the authorized work apps.

Zebra StageNow barcode enrollment is a supported bulk method for Android Enterprise Fully Managed devices and needs minimal interaction. Enrolling with a multi-user staging account (Android Shared Device Mode = Launcher) turns on shared-device check-in/check-out in Workspace ONE Launcher: the device is locked to the authorized apps, each worker logs in to receive only their assigned resources, and the session is cleared at check-in so the device is ready for the next worker. Work Profile is for BYOD, and scheduled enterprise wipes would unenroll the devices.

Correct answer: siem.company.com

The Syslog General tab has separate fields: Host Name (the SIEM address, for example siem.company.com), Protocol (UDP, TCP or Secure TCP) and Port. Enter siem.company.com as the Host Name, choose TCP as the Protocol, and enter 514 as the Port. The protocol and port are not written into the Host Name value.

Correct answer: Work Profile (Profile Owner)

The Android Enterprise Work Profile (Profile Owner) mode is specifically designed for BYOD scenarios. It creates a secure, encrypted container on the device that isolates corporate apps and data from the user's personal space. Administrators have full control over the work profile, including the ability to wipe it remotely, but have no visibility or control over the personal side of the device, thus preserving user privacy.

Correct answer: False

False. Device profiles do not override each other by name. Each profile is a separate resource with its own Managed By OG and assignments. A profile managed at the parent OG stays assigned to the devices it targets and is read-only for child-OG administrators. A profile created at the child OG is simply another profile, so both are delivered if both are assigned. To change what child devices receive, change the assignments (for example, exclude the child devices from the parent profile) rather than relying on a same-name 'override'.