Missing Root CA Certificate in Wi-Fi SCEP Authentication
You are troubleshooting a Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is enrolled in Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The user can connect to other Wi-Fi networks. What is the most likely cause?
Quick Answer
The most likely cause is that the root CA certificate required to validate the RADIUS server certificate is not installed on the device. When troubleshooting Wi-Fi SCEP authentication, the client must trust the issuing certificate authority to complete the EAP-TLS handshake; without the root CA, the device rejects the server certificate even though the Wi-Fi profile and SCEP client certificate are correctly deployed. On the MD-102 exam, this scenario tests your understanding of certificate trust chains in Intune-managed Wi-Fi profiles—a common trap is assuming the SCEP certificate itself is the problem, when the missing root CA specifically breaks server validation. Remember that the device can connect to other networks, isolating the issue to the corporate RADIUS server’s certificate chain. A helpful memory tip: “No root, no route”—without the root CA, the client won’t trust the server, so the authentication handshake fails.
⚠ Common exam trap
Candidates often confuse a missing root CA certificate with a missing client certificate, but the symptom of being able to connect to other networks isolates the problem to server-side certificate validation, not client-side enrollment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The root CA certificate required to validate the RADIUS server certificate is not installed on the device.
The device can connect to other Wi-Fi networks but not the corporate one, indicating the issue is specific to the corporate network's authentication requirements. Since the profile uses SCEP certificate authentication, the device must trust the root CA that issued the RADIUS server certificate to validate the server during the EAP-TLS handshake. If the root CA certificate is missing, the client will reject the RADIUS server certificate, causing the connection to fail. This is the most likely cause because the profile assignment and driver are not specific to this single network failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user's password has expired.
Why it's wrong here
SCEP certificate authentication validates a device certificate, not user credentials, so an expired password cannot block this Wi-Fi association; the user's other networks still work. Password expiry matters where PEAP-MSCHAPv2 or EAP-TTLS uses domain credentials, which is a different authentication method entirely.
- ✓
The root CA certificate required to validate the RADIUS server certificate is not installed on the device.
Why this is correct
SCEP certificate authentication requires the device to trust the RADIUS server's certificate chain. Without the root CA certificate installed via an Intune trusted certificate profile, the device rejects the server during the TLS handshake, so the Wi-Fi connection fails while other networks work.
- ✗
The Wi-Fi profile is not assigned to the user's device.
Why it's wrong here
An unassigned profile would leave no corporate SSID configured on the device, but the stem states a Wi-Fi profile is assigned and deployed. Assignment gaps are the cause when Intune shows no profile targeting the device group, not when a profile is present but authentication fails.
- ✗
The device's Wi-Fi adapter driver is outdated.
Why it's wrong here
An outdated driver would prevent all Wi-Fi connectivity, yet the user joins other networks successfully, so the adapter functions. Driver updates address hardware or firmware faults affecting every SSID; here the failure is scoped to one network requiring a valid SCEP-issued certificate.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Enrolling Devices with Microsoft Intune
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
Key term
Windows 11
Windows 11 is Microsoft's latest desktop operating system, offering a redesigned interface, enhanced security features, and improved support for modern hardware.
About these practice questions
One of 556 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are troubleshooting a user's Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is managed by Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The certificate is issued by your internal CA. The device shows 'No internet access' though it connects. What is the most likely issue?
medium- A.The SSID in the profile is incorrect
- ✓ B.The root CA certificate is not deployed to the device
- C.The user does not have an Intune license
- D.The Wi-Fi profile is not assigned to the device
Why B: The device connects to the Wi-Fi network but shows 'No internet access,' indicating the SSID and connectivity are functional. With SCEP certificate authentication, the client must trust the issuing CA's root certificate to validate the server-side certificate during the EAP-TLS handshake. If the root CA certificate is not deployed to the device via Intune, the certificate chain cannot be verified, causing the connection to fail at the authentication layer even though the Wi-Fi association succeeds.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.