An organization uses ClearPass to manage network access for its devices. A device reported as stolen is detected attempting to connect to the…

Upon receiving an HTTP API call from ClearPass indicating a device's status has changed to "stolen," the Enterprise Mobility Management (EMM) server can execute a range of pre-configured security actions on the device itself. Standard EMM capabilities for a compromised or stolen device include remotely locking the device, sending a custom message to the lock screen (e.g., "This device is lost, please contact IT"), or initiating a corporate or full device wipe to protect sensitive data. These actions are central to the security function of an EMM platform.

A. Blocking network traffic is a network-level enforcement action typically performed by a switch or firewall based on a policy (e.g., VLAN assignment) from ClearPass.

C. While an EMM might disable a network interface, a remote wipe or lock are more common, comprehensive, and standardized security responses for a stolen device.

1. Aruba Networks, "ClearPass Integration with EMM/MDM," Solution Guide, page 5, "Use Cases". The guide lists actions such as "Wipe corporate data from a device" and "Lock a device" as typical remediation actions that ClearPass can trigger on an MDM/EMM server.

2. VMware Workspace ONE UEM, "Device Actions," VMware Docs. (Representative EMM documentation). This official documentation lists "Device Wipe," "Send Message," and "Device Lock" as core remote actions available to administrators, confirming these are standard EMM functions.