Pass the VMware Certified Specialist - Workspace ONE 21.X UEM Troubleshooting 2023 5V0-62.22 Questions and answers with ExamsMirror

The AWCM page that would provide a detailed summary of the health of the AWCM service is /awcm/healthv2. This page displays various information about the AWCM service, such as version, uptime, memory usage, threads, connections, messages, and errors1. This page can help monitor and diagnose the performance and status of the AWCM service.

According to the Device enrollment issues with Workspace ONE article3, one of the possible causes of enrollment failure is that the ACC service is not working properly or cannot communicate with the directory service. The administrator can review the ACC logs and test the connection to verify if there are any errors or issues with the ACC service or configuration.

The logs that the administrator should review to begin troubleshooting the Android directory account enrollment issue are AirWatch Cloud Connector (ACC) logs. The ACC is responsible for integrating Workspace ONE UEM with directory services such as Active Directory or LDAP. If the administrator is unable to enroll Android devices with directory accounts, it could indicate that there is a problem with the ACC configuration, connectivity, or synchronization. The administrator should review the ACC logs to identify and troubleshoot the root cause of the issue3.

The troubleshooting step that should be taken next to find the root cause, while not causing any data loss to the end user’s device, is to gather device side logging. Device side logging can help collect more detailed information about device events, actions, and errors for troubleshooting purposes. Device side logging can be enabled from the Workspace ONE UEM console or from the device itself. Device side logging does not affect the user’s data or settings on the device.

 The most likely cause of this issue is that the VPN payload in a device profile is configured incorrectly in UEM. The VPN payload defines how devices connect to the VMware Tunnel edge service and access internal resources. If the VPN payload is incorrect, the devices will not be able to establish a VPN connection with the VMware Tunnel edge service and “Test Connection” with VMware Tunnel will fail. The organization should review and correct the VPN payload settings in UEM. The other options are not likely causes of this issue because:

The Device Traffic Rules are configured in UEM, not in Unified Access Gateway. They define which applications or domains are allowed or blocked by the VMware Tunnel edge service.

If the Device Traffic Rules are incorrect in UEM, they would affect all devices that connect to the VMware Tunnel edge service, not just “Test Connection” with VMware Tunnel.

If the Unified Access Gateway is unable to communicate with UEM, it would affect all edge services that require UEM integration, such as Content Gateway and Horizon, not just VMware Tunnel.

 The form of logging that should be used to accomplish this goal is device-based targeted logging. Device-based targeted logging allows the administrator to enable debug logging for multiple devices at once, based on various criteria, such as platform, model, ownership, and so on1. Device-based targeted logging can help collect more detailed information about device events, actions, and errors for troubleshooting purposes.

The console page that should be used to meet these goals is Devices > Lifecycle > Enrollment Status. This page allows the administrator to view and manage the enrollment status of devices, such as blocked, unenrolled, or pending1. The administrator can also remove the block on a device that was enterprise wiped with the prevent re-enrollment option, and allow the user to re-enroll the device.

The communication path that should be reviewed is AWCM outbound to UAG. AWCM (AirWatch Cloud Messaging) is a service that delivers push notifications to devices and enables device-based commands from the Workspace ONE UEM Console3. AWCM also communicates with UAG (Unified Access Gateway) to send server traffic rules for tunnel to proxy certain URLs. If AWCM cannot communicate with UAG, the server traffic rules will not be updated on UAG and the sites/apps will be proxied incorrectly. The administrator should check and resolve any issues with AWCM outbound to UAG communication.

The service that the organization administrator has direct control over to enable verbose logging to troubleshoot this issue is ACC (AirWatch Cloud Connector) service. ACC is a service that integrates Workspace ONE UEM with internal enterprise systems, such as Active Directory or Certificate Authority. ACC enables Workspace ONE UEM to use internal resources without exposing them to the Internet. If some users are unable to enroll their devices using their Active Directory accounts, it could indicate that there is a problem with ACC configuration, connectivity, or synchronization. Enabling verbose logging for ACC can help identify and troubleshoot the root cause of the issue.