Check Your Understanding / Deployment and Management

Question 1

What links a device to an MDM (mobile device management) solution?

A. APNs
B. Firewall
C. Restriction
D. Enrollment profile

Answer 1

D. Enrollment profile

Enrollment profiles are the links between devices and the MDM solution.

Question 2

What does MDM need to operate, specifically for APNs and SSL?

A. Certificates
B. Restrictions
C. Enrollment profiles

Answer 2

A. Certificates

Question 3

Which Apple device capability allows MDM to secure devices?

A. Location Services
B. Enrollment profiles
C. Built-in device security features

Answer 3

C. Built-in device security features

An MDM solution allows you to use the device’s built-in security features.

Question 4

Which statement about the Apple management framework is true?

A. It’s built into Apple devices.
B. It doesn’t support personal devices.
C. It provides settings created by third parties to manage Apple devices.

Answer 4

A. It’s built into Apple devices.

Each MDM solution uses the built-in Apple management framework in iOS, iPadOS, macOS, and tvOS to manage features and settings for each platform.

Question 5

After a device has enrolled with an MDM server, what happens next?

A. The device reports status to the server.
B. The device polls the server for any commands.
C. The server sends push notifications to the device.

Answer 5

C. The server sends push notifications to the device.

After a device enrolls with the MDM server, the server sends push notifications to the device when there are commands to process on the device.

Question 6

What transformative update to the MDM protocol allows a device to react autonomously to its own state changes and apply management logic to itself without cues from the server?

A. User Enrollment
B. Device Assignment
C. Declarative Management

Answer 6

C. Declarative Management

Declarative management allows the device to be autonomous and proactive, freeing up the server to be lightweight, reactive, and able to subscribe to updates without constant polling.

Question 7

When is it recommended to test beta software releases?

A. Quarterly
B. Year-round
C. When new devices are added to your organization

Answer 7

B. Year-round

A modern approach to managing Apple devices involves committing to the latest software, testing year-round, and ensuring that everything works together.

Question 8

In which type of enrollment and ownership model can users personalize apps and data on their managed devices?

A. BYOD, organization-owned
B. Nonpersonalized, organization-owned
C. Personally enabled, organization-owned

Answer 8

C. Personally enabled, organization-owned

The organization assigns devices to users, and after configuration, users can personalize their devices with their own apps and data.

Question 9

In which type of ownership model can users personalize apps and data on their personal devices?

A. BYOD, User Enrollment
B. BYOD, organization-owned
C. Nonpersonalized, organization-owned
D. Personally enabled, organization-owned

Answer 9

A. BYOD, User Enrollment

BYOD users can customize their personal devices before and after enrolling them in an MDM solution.

Question 10

In which ownership model can IT administrators restrict the installed apps and personal data on a device meant to be shared with multiple users?

A. BYOD, User Enrollment
B. BYOD, personally enabled
C. Nonpersonalized, organization-owned
D. Personally enabled, organization-owned

Answer 10

C. Nonpersonalized, organization-owned

IT administrators typically centrally configure and manage shared or single-purpose devices.

Question 11

How do you enroll devices ineligible for automatic enrollment in Apple Business Manager or Apple School Manager?

A. Device Enrollment
B. Automated Device Enrollment
C. Automatic enrollment
D. No enrollment possible

Answer 11

A. Device Enrollment

You can choose to manually enroll devices into your MDM solution by installing an enrollment profile locally on the devices.

Question 12

Which type of enrollment is ideal for devices you need to distribute to multiple users in multiple regions?

A. Device Enrollment
B. User Enrollment
C. Automated Device Enrollment

Answer 12

C. Automated Device Enrollment

Question 13

Which type of enrollment do you commonly use for BYOD deployments?

A. Device
B. User
C. Automated device

Answer 13

B. User

BYOD deployments most commonly employ User Enrollment. You can provide BYOD users a customized URL to an enrollment portal.

Question 14

What do you need to consider when evaluating MDM solutions?

A. Support for watchOS
B. Pricing structure and subscription model
C. A device’s life cycle and trade-in value

Answer 14

B. Pricing structure and subscription model

Understand your organization’s budget and growth projections, then compare MDM solution pricing and subscription options.

Question 15

Which is a deployment model to consider as part of your device management goals?

A. Application Programming Interface (API)
B. Over-the-air (OTA) enrollment
C. One-to-one

Answer 15

C. One-to-one

Also known as personally enabled, one-to-one is a deployment model you can consider when understanding your organization’s needs.

Question 16

Which is an important user authentication feature of an MDM solution that you should consider?

A. Support and integration with your identity provider or directory service
B. Support for future versions of macOS, iOS, and iPadOS
C. Support for the BYOD deployment model

Answer 16

A. Support and integration with your identity provider or directory service

Verify if the MDM solution supports your current identity provider or directory service.

Question 17

Which aspects of your organization’s infrastructure should you evaluate to ensure that it meets the network roaming needs of users throughout a building?

A. Number of devices per user
B. Wi-Fi coverage and capacity
C. Adequate number of access points per device
D. Sources of interference caused by construction materials

Answer 17

B. Wi-Fi coverage and capacity

Evaluating Wi-Fi coverage and capacity helps you strategically place wireless access points that have enough power to meet the roaming needs throughout your organization’s facilities.

Question 18

Which type of network uses individual user credentials or device- and/or user-based certificates to control who or what devices can use the network?

A. Provisioning network
B. WPA2 Personal network
C. WPA2 Enterprise network

Answer 18

C. WPA2 Enterprise network

WPA2 Enterprise network uses individual user credentials or device- and/or user-based certificates to control who or what devices can use the network.

Question 19

Which functions require Apple devices to continuously access APNs?

A. Bonjour access, content caching, and internet connection sharing
B. SSO, VPN connectivity, and Wi-Fi network roaming
C. Notifications of operating-system and app updates, MDM policies, and messages
D. Ad and location tracking, Keychain data backup, and app suggestions

Answer 19

C. Notifications of operating-system and app updates, MDM policies, and messages

Apple devices learn of operating-system and app updates, MDM policies, and incoming messages through continuous access to APNs. Make sure that your organization allows network traffic access to Apple’s network on the entire 17.0.0.0/8 address block on port 5223, with a fallback option of port 443.

Question 20

What should you do to ensure that Apple devices can access APNs and other Apple services on your organization’s network?

A. Configure all devices to auto-establish secure VPN access to Apple’s network.
B. Deploy devices with an SSO payload that are configured to allow access to Apple’s network.
C. Adjust network configurations on web proxies or firewall ports to allow access to Apple’s network.
D. Set up your network to work with Bonjour so that devices can connect to APNs and Apple services.

Answer 20

C. Adjust network configurations on web proxies or firewall ports to allow access to Apple’s network.

For Apple devices to access APNs and Apple services, you might need to adjust network configurations on web proxies or firewall ports to allow network traffic access to Apple’s network. Make sure that your organization allows network traffic access to Apple’s network on the entire 17.0.0.0/8 address block on port 5223, with a fallback option of port 443.

Question 21

Which is the most commonly deployed authentication technology that both AD and SSO use?

A. Kerberos
B. MSCHAPv2
C. OAuth
D. SAML

Answer 21

A. Kerberos

Kerberos is the most commonly deployed authentication technology that both AD and SSO use.

Question 22

What is used for personalized setup of a managed device?

A. Apple Configurator
B. MDM solution
C. Setup Assistant

Answer 22

C. Setup Assistant

Setup Assistant is used for personalized setup of a managed device.

Question 23

Why might you create a security policy that enforces the use of FileVault for data encryption on a managed Mac?

A. This policy ensures that users can’t disable FileVault.
B. When you turn on FileVault using an MDM solution, it adds a Recovery Key to a user’s iCloud account.
C. FileVault is compatible with any Apple device.
D. You can use third-party encryption algorithms to configure FileVault.

Answer 23

A. This policy ensures that users can’t disable FileVault.

Users can’t disable FileVault if it’s enforced with a configuration profile on managed Mac computers.

Question 24

Which benefit helps IT administrators reduce the need to perform extensive configurations on Apple devices?

A. Many security features are turned on by default.
B. Users can select a security profile in Setup Assistant.
C. IT administrators can deliver and enforce policies without an MDM solution.
D. IT administrators can issue remote commands to devices to erase all private information.

Answer 24

A. Many security features are turned on by default.

Because many security features on Apple devices are turned on by default, administrators save time when they configure devices.

Question 25

What happens if your Apple device can’t validate the trust chain of a signing CA?

A. The service encounters an error.
B. The CA is added to the unapproved list.
C. The user is asked to enter the device password or passcode.

Answer 25

A. The service encounters an error.

If your Apple device can’t validate the trust chain of a signing CA, the service encounters an error.

Question 26

Which MDM payload setting can you use to turn off updating certificates wirelessly for iPhone and iPad devices?

A. Automatic sync while roaming
B. Allow users to accept untrusted TLS certificates
C. Allow automatic updates to certificate trust settings

Answer 26

C. Allow automatic updates to certificate trust settings

When you deselect this option and push the payload to your device, you prevent wireless certificate updates.

Question 27

You’ve installed a payload on your managed Apple device that prevents users from accepting untrusted TLS certificates.

What happens when users try to access a webpage that uses an untrusted TLS certificate and then tap Show Details?

A. They’re asked to contact the issuing CA to validate the certificate.
B. They can tap “view the certificate,” but they can’t trust this certificate or visit the site.
C. They can’t tap “view the certificate,” and they can view only the unsecured version of the webpage.

Answer 27

B. They can tap “view the certificate,” but they can’t trust this certificate or visit the site.

When you deselect the option “Allow users to accept untrusted TLS certificates,” users can’t accept untrusted TLS certificates or visit sites that use untrusted certificates.

Question 28

How do you configure Custom Apps to appear in the sidebar?

A. In Settings, select Apps and Books, then click Enable next to Custom Apps.
B. In Settings, select Enrollment Information, then click Enable next to Custom Apps.
C. In Roles, choose the role for which to enable custom apps, then select the View Custom Apps checkbox.

Answer 28

B. In Settings, select Enrollment Information, then click Enable next to Custom Apps.

You enable Custom Apps in Settings > Enrollment Information. When you enable the Custom Apps option, it appears below the Content section in the sidebar.

Question 29

What is the purpose of using federated authentication with Apple Business Manager or Apple School Manager?

A. Federated authentication links to your Google Workspace or Azure AD domain.
B. Federated authentication verifies your organization’s eligibility.
C. Federated authentication verifies ownership of the domains that you use with your portal.

Answer 29

A. Federated authentication links to your Google Workspace or Azure AD domain.

When you link to Google Workspace or Azure AD, users can leverage their user names and passwords as Managed Apple IDs.

Question 30

You didn’t import user data into Apple Business Manager after configuring federated authentication.

Which Apple Business Manager settings pane can you use to import user data into Apple Business Manager?

A. Accounts
B. Directory Sync
C. Enrollment Information

Answer 30

B. Directory Sync

In the Directory Sync pane, you can sync Apple Business Manager with user data from your Google Workspace or Azure AD.

Question 31

Which of the following roles has the least user privileges?

A. Staff
B. Administrator
C. Content Manager

Answer 31

A. Staff

The Staff role has the least user privileges.

Question 32

Which type of additional user should you create immediately after signup is complete?

A. Administrator
B. Device Enrollment Manager
C. People Manager
D. Content Manager

Answer 32

A. Administrator

After signup is complete, you’re the only person who can sign in. Create a second administrator account in case you can’t sign in for some reason.

Question 33

Which roles must your account have to add or edit locations in Apple Business Manager?

A. Administrator or Site Manager
B. Administrator or People Manager
C. People Manager or Content Manager

Answer 33

B. Administrator or People Manager

Only an Administrator or a People Manager can add or edit locations in Apple Business Manager.

Question 34

You’ve created a number of users with Content Manager, Device Enrollment Manager, and People Manager roles.

What should you do next to give each user access?

A. Enter a secure password for each user.
B. Ask each user to enroll in your portal.
C. Create sign-in information and email it to each user.

Answer 34

C. Create sign-in information and email it to each user.

You can choose to either email users their sign-in information directly or download it as a PDF or CSV file.

Question 35

Which statement about adding an MDM server in Apple Business Manager or Apple School Manager is true?

A. Adding an MDM server creates a link to your MDM solution.
B. Adding an MDM server eliminates the need for an MDM solution.
C. Adding an MDM server configures an additional server in your MDM solution.

Answer 35

A. Adding an MDM server creates a link to your MDM solution.

Adding an MDM server establishes a secure relationship between your MDM solution and Apple Business Manager or Apple School Manager.

Question 36

What’s the purpose of the public key certificate file that you download from your MDM server before you add the server to your Apple Business Manager or Apple School Manager portal?

A. It enables the MDM server to securely send email through the portal.
B. It configures two-step verification between your MDM server and the portal.
C. It contains a public key that the MDM server uses to encrypt the portal server token.

Answer 36

C. It contains a public key that the MDM server uses to encrypt the portal server token.

You upload the public key certificate file to Apple Business Manager or Apple School Manager when you add your MDM server.

Question 37

After you add your MDM server in your Apple Business Manager or Apple School Manager portal, what must you do so that the MDM server securely connects to the portal?

A. Enter the encryption key that the portal generates into the MDM server.
B. Verify that the secure URL for your MDM server in the portal is correct.
C. Download the server token from the portal and upload it to the MDM server.

Answer 37

C. Download the server token from the portal and upload it to the MDM server.

The server token is a P7M file that your MDM server uses to securely connect to Apple Business Manager or Apple School Manager.

Question 38

Which Apple Configurator tool do you use to add donated iPhone and iPad devices to Apple Business Manager or Apple School Manager?

A. Device Assignments
B. Blueprints
C. Profile Editor
D. Prepare Assistant

Answer 38

D. Prepare Assistant

You can manually add iPhone and iPad devices to Apple Business Manager or Apple School Manager using Apple Configurator with Prepare Assistant.

Question 39

What happens if a Wi-Fi payload is not included in a configuration profile when manually adding iPhone or iPad to Apple Business Manager or Apple School Manager?

A. The device is added to Apple Business Manager or Apple School Manager, but won’t be able to connect to Wi-Fi.

B. Adding the device fails with a network error.

C. Apple Configurator continues to try to add the device to Apple Business Manager or Apple School Manager until you click Cancel.

Answer 39

B. Adding the device fails with a network error.

Because iPhone and iPad devices require an internet connection to be added to Apple Business Manager or Apple School Manager, you must install a configuration profile with a Wi-Fi payload.

Question 40

How can you see more detailed information about devices in Apple Configurator after you start adding them manually?

A. From the Apple Configurator menu bar, choose View > Show Status Bar.

B. From the Apple Configurator menu bar, choose File > Get Info after choosing a device from the Apple Configurator main window.

C. From the Apple Configurator menu bar, choose Window > Activity.

Answer 40

C. From the Apple Configurator menu bar, choose Window > Activity.

The Activity window shows detailed information about the device, including activation status, enrollment status, and errors.

Question 41

You want to integrate your MDM solution with Apps and Books for managed distribution to your devices.

What must you download in Apple Business Manager and then upload to your MDM solution?

A. A server token
B. A public key certificate
C. A CSV file containing all device serial numbers
D. Your organization’s Apple Customer ID

Answer 41

A. A server token

The server token is a file that connects your MDM solution to the volume purchasing feature.

Question 42

Your organization wants to retain full ownership and control of apps that you purchased through Apps and Books.

Which license type should you choose?

A. Custom licenses
B. Managed licenses
C. Redemption codes
D. Supervised licenses

Answer 42

B. Managed licenses

Choose Managed when you purchase licenses for managed distribution. Your organization retains full ownership and control of apps through assignment with your MDM solution.

Question 43

You purchase books and choose licenses for managed distribution.

What happens to ownership of the books when you distribute them?

A. Book ownership always transfers to users. You can’t revoke or reassign books.
B. You choose whether you want to retain or transfer ownership of books when you distribute them.
C. The organization retains full ownership and control, so you can revoke and reassign them later.

Answer 43

A. Book ownership always transfers to users. You can’t revoke or reassign books.

Regardless of whether you choose licenses for managed distribution or redemption codes, book ownership always transfers to the user.

Question 44

What must multiple subnets share so that a network can use a single content cache, without requiring DNS changes?

A. DNS
B. Subnet
C. Bandwidth
D. Public IP Address

Answer 44

D. Public IP Address

You can set the caching server to provide content caching for subnets of the local network that share a common public IP address.

Question 45

When an iPhone device on your network tries to download Apple content that could be cached, the Apple content server instructs the device to check with the local network’s cache first.

A. True
B. False

Answer 45

A. True

With content caching, when an iPhone device on your network downloads an iOS update from the App Store, content caching keeps a copy of the update.

Question 46

Which issue could arise when multiple devices request the same data and caching is NOT turned on?

A. Data becomes less secure.
B. Bandwidth consumption increases.
C. Only the first device can download the requested data.
D. No issue — each device downloads the requested data.

Answer 46

B. Bandwidth consumption increases.

When the second device requests the same content, the bandwidth consumption doubles because the second device also needs to download the content from the internet.

Question 47

For best results, deploy content caching on a Mac that has a single wired Ethernet connection as its only network connection.

A. True
B. False

Answer 47

A. True

Use an Ethernet connection to the network for best results.

Question 48

Where do you turn on content caching on your Mac?

A. System Preferences > Security & Privacy
B. System Preferences > Sharing
C. System Preferences > Network
D. System Preferences > Profiles

Answer 48

B. System Preferences > Sharing

Use the Content Caching option in Sharing preferences to manage content caching on your Mac.

Question 49

Which setting should you select to prevent your computer from going to sleep and interfering with content caching?

A. Wake for network access
B. Put hard disks to sleep when possible
C. Enable Power Nap while plugged into a power adapter
D. Prevent computer from sleeping automatically when the display is off

Answer 49

D. Prevent computer from sleeping automatically when the display is off

Content caching requires the Mac to be turned on.

Question 50

With internet connection sharing, you can use a Mac computer’s internet connection to cache content for iPhone or iPad devices that are physically connected to the Mac through USB.

A. True
B. False

Answer 50

A. True

A Mac with internet connection sharing turned on and with an Ethernet connection can cache content for iPhone and iPad devices.

Question 51

Which advanced option do you use to set the cache size?

A. Peers
B. Storage
C. Clients
D. Parents

Answer 51

B. Storage

You view and set the cache size in the Storage tab.

Question 52

When you use Activity Monitor to check performance statistics for content caching, which comparison can tell you whether content caching is helping?

A. The closer the Maximum Cache Pressure value is to the Data Served value, the more content caching is helping.

B. The further the Maximum Cache Pressure value is from the Data Served value, the more content caching is helping.

C. The closer the Data Served From Cache values are to the Data Served values, the more content caching is helping.

D. The further the Data Served From Cache values are from the Data Served values, the more content caching is helping.

Answer 52

C. The closer the Data Served From Cache values are to the Data Served values, the more content caching is helping.

Comparing the closeness of these two values is the best way to determine how content cache is helping.

Question 53

Where does the content caching service send log messages?

A. To the main system.log
B. To the subsystem com.apple.AssetCache
C. To the subsystem com.apple.ContentCache
D. To the subsystem com.apple.AssetCacheManagerUtil

Answer 53

B. To the subsystem com.apple.AssetCache

Specifying this subsystem in the log command filters the displayed results to those associated with content caching.

Question 54

Which command can you use to configure advanced settings for content caching?

A. defaults write
B. AssetCacheManagerUtil status
C. AssetCacheManagerUtil settings

Answer 54

A. defaults write

When used with sudo, the defaults write command allows you to configure advanced settings for content caching.

Question 55

Which tool can you use to display advanced settings for the content caching service?

A. Activity Monitor
B. Console
C. System Preferences
D. Terminal

Answer 55

D. Terminal

You can use the command line interface in Terminal to configure all settings, both basic and advanced, for content caching.

Question 56

Which statement about entering Apple Customer Numbers and Reseller Numbers is correct?

A. You can enter both an Apple Customer Number and a Reseller Number.
B. You can enter an Apple Customer Number or a Reseller Number but not both.
C. You can enter only one Apple Customer Number, but multiple Reseller Numbers.

Answer 56

A. You can enter both an Apple Customer Number and a Reseller Number.

You can enter both an Apple Customer Number and a Reseller ID and even add multiple numbers if you need them.

Question 57

Your organization has multiple MDM servers linked in Apple Business Manager or Apple School Manager.

What should you do to automatically assign iPhone devices and Mac computers to different MDM servers?

A. Choose your preferred assignment method in MDM Server Assignment, then select the default MDM server for each device type.

B. Edit the assignment options in Default MDM Server Assignment settings and choose a different server for iPhone devices and Mac computers.

C. Upload a CSV file containing iPhone device serial numbers and assign them to one MDM server, then Upload a CSV file for Mac computers and assign them to a different MDM server.

Answer 57

B. Edit the assignment options in Default MDM Server Assignment settings and choose a different server for iPhone devices and Mac computers.

If you have linked more than one MDM server, you can choose default assignments by device type in Default MDM Server Assignment settings.

Question 58

You made multiple orders for new iPhone devices and want the devices from one order assigned to a different MDM server than the others.

What’s the best way to do that?

A. Use MDM Server Assignment to change the Default MDM Server Assignment for iPhone.

B. Select Devices, filter by order number and device type, then select all devices to change assignments.

C. Use MDM Server Assignment to enter a new Reseller Number for the order to filter device assignments.

D. Use Devices to download a CSV file containing iPhone device serial numbers for that order only. Edit the file and upload it with the unique server assignment for the iPhone devices in that order.

Answer 58

B. Select Devices, filter by order number and device type, then select all devices to change assignments.

You can select All Devices to edit the MDM Server assignments of all devices matching the search criteria.

Question 59

You’re responsible for managing 10 identical iPad devices that your organization uses in a training classroom and networking isn’t available onsite. Each week you need to retrieve the files stored on each device by the recent students and set up the devices for a new class.

Which approach is best for this task?

A. Apple Configurator for Mac
B. Apple Configurator for Mac with Shared iPad
C. Apple Configurator for Mac with your MDM solution

Answer 59

A. Apple Configurator for Mac

You can use Apple Configurator for Mac to create a single backup image that you apply to all the devices at the start of class, and use it to retrieve files at the end.

Question 60

Which type of content can you assign with Apple Configurator for Mac?

A. Apps
B. User settings
C. Purchased music
D. Podcasts

Answer 60

A. Apps

Distributing apps to multiple Apple devices simplifies deployment.

Question 61

You can add content to a Blueprint or to devices in Apple Configurator for Mac only by dragging and dropping.

A. True
B. False

Answer 61

B. False

You can also add content to a Blueprint or a device through menu and toolbar options.

Question 62

Which type of information about iPad can you view in Apple Configurator for Mac?

A. Camera status
B. iPad location
C. Console log
D. Ebook licenses

Answer 62

C. Console log

You can find the Console log by choosing File > Get Info from the Apple Configurator for Mac menu bar.

Question 63

How do you install the cfgutil tool?

A. From the App Store
B. From Apple Configurator for Mac
C. From Profile Manager
D. From /Applications/Utilities on your Mac

Answer 63

B. From Apple Configurator for Mac

The cfgutil tool is one of the automation tools that you can install from Apple Configurator for Mac.

Question 64

Which tool can you use to automate configurations with shell scripts?

A. Blueprints
B. Automator app
C. Command-line tool cfgutil

Answer 64

C. Command-line tool cfgutil

The command-line tool cfgutil in the Terminal app helps you write shell scripts and automate specific processes.

Question 65

Which tool can you use to create your own workflows for bulk deployments?

A. Blueprints
B. Automator app
C. Command-line tool

Answer 65

B. Automator app

You can use the Automator app to create automated workflows for others to use when configuring devices.

Question 66

Which tool can you use to automate configurations with a template tool to add configuration profiles and apps?

A. Blueprints
B. Automator app
C. Command-line tool

Answer 66

A. Blueprints

Blueprints use template tools to record actions that you can then apply to devices.

Question 67

What is a configuration profile?

A. A System Report file with hardware and software configuration from a device
B. An automation file to script Apple Configurator actions
C. A file with user data from Apple devices
D. A file with payloads for Apple devices

Answer 67

D. A file with payloads for Apple devices

A profile is a file with payloads that contain settings and authorization information for Apple devices.

Question 68

Which method can you use to build configuration profiles with payloads specific to macOS?

A. Apple Configurator
B. Apple Business Manager
C. An MDM solution

Answer 68

C. An MDM solution

To create custom configuration profiles that contain settings specific to macOS, use an MDM solution.

Question 69

Which tool can you use to set up payloads for Apple TV?

A. Profile Editor
B. Prepare Assistant
C. Setup Assistant
D. Blueprints

Answer 69

A. Profile Editor

Use the Profile Editor to create configuration profiles for Apple TV as well as iPhone and iPad devices.

Question 70

An MDM solution is the only way to create and distribute a configuration profile.

A. True
B. False

Answer 70

B. False

You can also create a configuration profile with Apple Configurator and then distribute it using a message, a web page, Apple Configurator, or an MDM solution.

Question 71

What is the benefit of signing configuration profiles?

A. A signed profile prevents users from removing the profile from the device.
B. Signing a configuration profile makes it more resistant to tampering during distribution.
C. Signing a configuration profile allows a device to communicate securely with an MDM solution.

Answer 71

B. Signing a configuration profile makes it more resistant to tampering during distribution.

If someone modifies a profile after you sign it, the MDM framework won’t allow that profile to be installed on a device.

Question 72

Which payload prevents a user from later configuring an option that is hidden in Setup Assistant during device setup?

A. App Configuration
B. Parental Controls
C. Restrictions
D. Security & Privacy

Answer 72

C. Restrictions

Configure Restrictions to restrict functions for Setup Assistant options that you hide during device setup. Restrictions remain in place until they’re removed.

Question 73

Which of the following lets you configure what Setup Assistant panes users see during device setup?

A. App Configuration
B. Require credentials for enrollment
C. Assign devices to your MDM solution in Apple Business Manager or Apple School Manager.
D. Security & Privacy

Answer 73

C. Assign devices to your MDM solution in Apple Business Manager or Apple School Manager.

You must configure them to enroll during setup.

Question 74

Users can complete Setup Assistant on a Mac without a network connection.

A. True
B. False

Answer 74

A. True

Users can complete Setup Assistant on a Mac without a network connection, which prevents MDM enrollment at that time. When the Mac connects to a network after setup is complete, macOS notifies users to enroll in the MDM solution and reminds them periodically until they enroll.

Question 75

Before you can configure Setup Assistant options, you must configure devices to enroll in device management during setup.

A. True
B. False

Answer 75

A. True

After you configure devices to enroll in MDM during setup, you can configure Setup Assistant options.

Question 76

How can you ensure only authorized users can enroll a device?

A. Select the Setup Assistant payload for iOS devices.
B. Select the Setup Assistant options that you want to display.
C. Select the option to require user authentication during enrollment.

Answer 76

C. Select the option to require user authentication during enrollment.

The user will need to authenticate in order to enroll.

Question 77

Setup Assistant guides users through setting up their Apple devices after they access the Home Screen.

A. True
B. False

Answer 77

B. False

Setup Assistant guides users before they get to the Home Screen.

Question 78

You can manage user devices through your MDM solution and still give users some freedom to personalize the configuration.

A. True
B. False

Answer 78

A. True

You can use your MDM solution to manage devices but still permit users to personalize some settings.

Question 79

You downloaded a configuration profile on iPhone from a website or an email message. Where on the device do you install it?

A. Install the profile in the Settings app.
B. Delete the attachment, and go to a webpage.
C. Don’t do anything because the profile installs automatically.

Answer 79

A. Install the profile in the Settings app.

Users install the profile in the Settings app.

Question 80

What happens when the user manually enrolls a device in the MDM solution?

A. Nothing happens until the user restarts the device.
B. The MDM solution records information about the device, such as the serial number and installed apps.
C. The user receives a web address where they can download the enrollment profile.
D. The user receives a web address where they can download the configuration profile.

Answer 80

B. The MDM solution records information about the device, such as the serial number and installed apps.

When the user connects to the MDM solution using the device, the MDM solution records information about the device.

Question 81

When a user removes an enrollment profile from their device, what else is also removed?

A. User data
B. The current operating system
C. Organization data
D. Managed apps based on that configuration profile

Answer 81

D. Managed apps based on that configuration profile

A user can remove an enrollment profile from their device, including all configuration profiles and their settings, as well as managed apps based on that enrollment profile.

Question 82

If users with their own personal devices leave a company, what do they do to disassociate their devices from an MDM solution?

A. Reset Location & Privacy settings.
B. Download a removal token.
C. Remove the Remote Management configuration profile from Settings in iOS and iPadOS or System Preferences in macOS.
D. Visit a specified self-service site to unenroll.

Answer 82

C. Remove the Remote Management configuration profile from Settings in iOS and iPadOS or System Preferences in macOS.

If users bring their own devices, they can remove the configuration profiles to disassociate from an organization’s MDM solution.

Question 83

As an IT administrator, how would you send new settings to user devices?

A. Send users a self-service URL.
B. Change and send the updated configuration profile.
C. Remove the configuration profile and send a new one.
D. Email users a link for a new configuration profile.

Answer 83

B. Change and send the updated configuration profile.

The easiest way to send new settings is to use your MDM solution to change and send an updated configuration profile to users.

Question 84

Your organization has a BYOD policy. As the IT administrator, what MDM enrollment options can you give users?

A. Send an enrollment profile by email or SMS.
B. Provide a self-service portal if supported.
C. All of the above

Answer 84

C. All of the above

Sending an enrollment profile by email or SMS and setting up a self-service portal are two common options you can offer users to enroll their devices.

Question 85

Which iPad is compatible with Shared iPad?

A. iPad Pro
B. iPad Air
C. iPad 4th generation
D. iPad mini 3

Answer 85

A. iPad Pro

Question 86

Which service can you configure on a Mac to temporarily store iCloud user data from shared iPad devices?

A. iCloud
B. Content Caching
C. Internet Sharing

Answer 86

B. Content Caching

When you have a Mac with the Content Caching service turned on, Shared iPad can locally save iCloud user data in addition to iPadOS and app updates.

Question 87

Where can you find apps that are “Optimized for Shared iPad”?

A. Apple Configurator
B. Classroom
C. Apps and Books

Answer 87

C. Apps and Books

Question 88

Which additional option is available when you configure Shared iPad?

A. Maximum amount of storage
B. Quota size per user
C. Maximum number of apps

Answer 88

B. Quota size per user

When you enroll iPad devices into Shared iPad, configure the quota size per user based on the iPad storage you think that your users will need.

Question 89

Which option is skipped when you configure Shared iPad successfully?

A. Wi-Fi
B. Setup Assistant
C. Restrictions

Answer 89

B. Setup Assistant

Setup Assistant is skipped if you configure Shared iPad successfully.

Question 90

Which Shared iPad feature allows users to sign in as a guest?

A. Classroom
B. Guest User
C. Temporary sessions

Answer 90

C. Temporary sessions

When you configure iPad devices for temporary sessions, a user can sign in to the device by tapping Guest at the sign-in screen.

Question 91

You can ship devices directly to users without touching or preparing the devices if your organization purchases them directly from a participating Apple Authorized Reseller or carrier and you automatically enroll them in MDM with Apple Business Manager or Apple School Manager.

A. True
B. False

Answer 91

A. True

Organizations that purchase devices directly from a participating Apple Authorized Reseller or carrier can enroll the devices automatically into an MDM solution with Apple Business Manager or Apple School Manager.

Question 92

When you set up a device with Setup Assistant, which of the following might you be asked to enter to complete the enrollment in MDM?

A. iCloud account credentials
B. Personal Apple ID credentials
C. Organizational credentials

Answer 92

C. Organizational credentials

If your organizaton requires your credentials, they provide additional device security to confirm the identity of authorized users.

Question 93

With help from a self-support site or app, what is a task that a user can complete?

A. Download internal business apps
B. Purchase apps from the App Store
C. Install personalized apps on a device
D. Enroll a device in Apple Business Manager or Apple School Manager

Answer 93

A. Download internal business apps

If an organization provides self-support sites, these sites can allow users to access device enrollment in MDM, downloads of internal business apps, and other device management services.

Question 94

What do you use to connect Apple devices to networks that use 802.1X EAP-TLS authentication?

A. A configuration profile
B. A PAC file
C. A .plist file

Answer 94

A. A configuration profile

To connect Apple devices to networks that use 802.1X EAP-TLS authentication, MDM administrators must create the appropriate settings for their networks in configuration profiles and then push them to their devices.

Question 95

Which security type do you use to configure managed Apple devices to connect to 802.1X networks?

A. WEP
B. WPA3 Enterprise
C. WPA3 Personal

Answer 95

C. WPA3 Enterprise

Configuring your managed Apple devices with this type gives them access to a broad range of 802.1X authentication environments.

Question 96

You can use WPA2/WPA3 Enterprise authentication at the login window of macOS.

A. True
B. False

Answer 96

A. True

You can authenticate to a network from the login window when your Mac is set up with a compatible directory service and configured to use this mode with MDM.

Question 97

EAP-TLS authentication uses a certificate identity that’s shared among all clients.

A. True
B. False

Answer 97

False

When authenticating Apple devices to EAP-TLS–protected networks, each client uses a unique certificate identity.

Question 98

How does a PAC file influence the way an Apple device communicates over a network?

A. The device uses the authentication credentials defined in the PAC file to connect to servers.
B. The device follows the PAC file rules that define the proxy server’s location and traffic allowed to connect directly.
C. The device constructs a list of approved websites by using the web addresses that the PAC file defines.

Answer 98

B. The device follows the PAC file rules that define the proxy server’s location and traffic allowed to connect directly.

The proxy server’s location and rules for allowed direct traffic defined in the PAC file manage the way an Apple device communicates over a network.

Question 99

Which of these alternatives to a proxy server URL could you use to configure a payload with proxy settings for an Apple device?

A. A .plist file with allowed websites
B. A domains restriction
C. WPAD using DHCP option 252

Answer 99

C. WPAD using DHCP option 252

When configuring an Apple device to use a proxy, you can use WPAD using DHCP option 252 instead of a proxy server URL.

Question 100

What must the server identity certificate contain in the SubjectAltName field?

A. The CA name
B. The rest of the trust chain
C. The user’s group name
D. The server’s DNS name or IP address

Answer 100

D. The server’s DNS name or IP address

The server identity certificate must contain the server’s DNS name or IP address in the SubjectAltName field.

Question 101

What must users of an MDM solution install so that custom VPN works on Apple devices?

A. Profile Manager and VPN Manager
B. The appropriate authentication app
C. Configuration profile and VPN Manager
D. VPN Manager and User Authentication Profile

Answer 101

B. The appropriate authentication app

You need the vendor’s VPN app.

Question 102

Which VPN connection type provides more granular control over which data goes through VPN?

A. Per-App VPN
B. VPN On Demand
C. Always-On VPN

Answer 102

A. Per-App VPN

Per-App VPN connections are established on a per-app basis, which provides more granular control over which data goes through VPN.

Question 103

How do you enable managed distribution?

A. Enroll devices in MDM.
B. Download a spreadsheet of app licenses.
C. Link your MDM solution to at least one location in Apple Business Manager or Apple School Manager.
D. Purchase content through Apps and Books in Apple Business Manager or Apple School Manager.

Answer 103

C. Link your MDM solution to at least one location in Apple Business Manager or Apple School Manager.

To enable managed distribution, you link your MDM solution to at least one location in your Apple Business Manager or Apple School Manager account.

Question 104

Which distribution model permanently transfers apps to users?

A. Custom apps
B. Redemption codes
C. Managed distribution to users
D. Managed distribution to devices

Answer 104

B. Redemption codes

Distributing app licenses through redemption codes transfers ownership of an app to the user who redeems the code.

Question 105

Your organization wants developers to read a software architecture book that you should purchase from Apps and Books. Funding is limited, so the engineering lead wants to know if books can be transfered between employees after they finish reading it.

Who has the authority to revoke a book license after distribution?

A. No one
B. The user
C. The content manager
D. The MDM administrator

Answer 105

A. No one

When you distribute books, ownership permanently transfers to the users; you can’t revoke or reassign book licenses.

Question 106

When you use managed distribution to assign apps directly to devices, your organization retains full control and ownership of the app licenses.

A.True
B. False

Answer 106

A.True

Using managed distribution with MDM, your organization retains full control and ownership of app licenses with the ability to assign, revoke, and then reassign apps to devices.

Question 107

How is an app installed on a user’s device after the app is assigned to that device?

A. The user must accept the app installation.
B. Your MDM solution automatically pushes the app to the device.
C. The user receives an invitation to download and install the app from the App Store.

Answer 107

B. Your MDM solution automatically pushes the app to the device.

Your MDM solution can automatically push it to that device without requiring user invitation or acceptance.

Question 108

When does the number of available app licenses for supervised devices change in your MDM solution apps library?

A. After the user installs or deletes the app
B. After the device user accepts or rejects the installation
C. After you assign or revoke an app to a device or device group

Answer 108

C. After you assign or revoke an app to a device or device group

After you assign or revoke an app using your MDM solution, the number of app licenses available for assignment adjusts accordingly.

Question 109

What must a user do before you can assign apps to them with managed distribution?

A. Install a managed distribution profile on their device
B. Accept an invitation to enroll in managed distribution
C. Sign in to an MDM solution and create a Managed Apple ID
D. Sign in to Apple Business Manager or Apple School Manager and enroll in Apps and Books

Answer 109

B. Accept an invitation to enroll in managed distribution

The user must accept the invitation by signing in with their Apple ID and agreeing to the terms and conditions.

Question 110

When you assign an app to a group for managed distribution, who must accept the invitation to enroll in managed distribution?

A. Your MDM solution administrator
B. Each individual user in the group
C. The Apple Business Manager or Apple School Manager administrator

Answer 110

B. Each individual user in the group

Each user in the group receives an invitation to enroll in managed distribution.

Question 111

How long must you wait to reassign an app after you’ve revoked it from a device or user?

A. You can reassign the app immediately.
B. You must wait 24 hours before reassigning the app.
C. You must wait 60 minutes before reassigning the app.
D. You can reassign the app to a device immediately, but you must wait 24 hours for a user assignment.

Answer 111

A. You can reassign the app immediately.

You can reassign an app immediately after you revoke it.

Question 112

What is one way to revoke all app licenses that you’ve assigned to a user?

A. Remove the MDM profile on the device.
B. Reassign the apps to another user or device.
C. Change the assigned location in Apple Business Manager or Apple School Manager.
D. Remove the user from managed distribution.

Answer 112

D. Remove the user from managed distribution.

Removing a user from managed distribution revokes all assigned app licenses and they must accept a new invitation to receive new app licenses. If you expect to assign app licenses to the user in the future, don’t remove them from managed distribution — revoke the individual licenses.

Question 113

What happens to an app’s function on a device when you revoke it from the user?

A. The user receives a notification on the device, and the app is removed immediately.
B. The app remains on the device, but it stops working as soon as it’s been revoked.
C. The App Store notifies the user that the app has been revoked and requires the user to purchase the app.
D. The App Store notifies the user that the app has been revoked, but the app continues to work for at least 30 days after it’s revoked.

Answer 113

D. The App Store notifies the user that the app has been revoked, but the app continues to work for at least 30 days after it’s revoked.

30 days after the notification, the app either stops working or continues to run, depending on whether the app developer opted to have the app stop working when revoked.

Question 114

What do you use on a managed, user-owned iPhone or iPad to prevent users from opening unmanaged attachments or documents in managed sources?

A. A restriction
B. A managed domain
C. A managed account

Answer 114

A. A restriction

Open In management uses a set of restrictions to prevent users from opening attachments or documents from managed sources in unmanaged destinations on a managed iPhone or iPad.

Question 115

On a user-owned iPhone enrolled in your MDM solution, you can prevent users from opening unmanaged attachments or documents in managed sources.

A. True
B. False

Answer 115

A. True

On a managed iPhone or iPad, you can prevent users from opening attachments or documents from managed sources in unmanaged destinations.

Question 116

Which condition applies when a managed pasteboard restriction is installed on a managed device?

A. The Paste button is dimmed.
B. The Paste button doesn’t appear.
C. A “Paste Not Allowed” notification displays.

Answer 116

C. A “Paste Not Allowed” notification displays.

If the user isn’t allowed to paste content in an app due to the restriction, they get a “Paste Not Allowed” notification that includes the organization name.

Question 117

Which type of payload do you use to prevent a user from removing system apps on iPhone?

A. Restrictions
B. Security & Privacy
C. Software Updates

Answer 117

A. Restrictions

Use a Restrictions payload to prevent users from removing system apps on iPhone.

Question 118

When you use MDM, you can prevent a Mac user from uninstalling a managed app.

A. True
B. False

Answer 118

B. False

When you use MDM to install a managed app, you can set the Removable attribute to prevent a user from uninstalling it from iPhone or iPad.

Question 119

Which types of apps are still available to download to the device?

A. Games and Reader apps
B. All free apps that don’t have in-app purchases
C. Managed Apps, MDM-installed apps, system apps, and updates to those apps

Answer 119

C. Managed Apps, MDM-installed apps, system apps, and updates to those apps

The device can still receive managed apps, MDM-installed apps, system apps, and updates to those apps despite restrictions on access to the App Store.

Question 120

An app that a user manually installs on a device — for example from the App Store — isn’t managed.

A. True
B. False

Answer 120

A. True

Only apps installed with an MDM solution are considered managed. MDM can take over management of a user-installed app, prompting the user to accept on an unsupervised device.

Question 121

Which apps can users use to open the email attachment in the organization account after Managed Open In restrictions are in place?

A. Only apps that the user installs
B. Any app installed on the device
C. Only apps installed from the App Store
D. Only managed apps that the MDM solution installs

Answer 121

D. Only managed apps that the MDM solution installs

Apps that the MDM solution installs are considered managed. You can apply restrictions to managed apps that limit how users can share attachments with unmanaged apps.

Question 122

Where can you confirm whether iCloud restrictions have been applied to a managed Mac?

A. In Keychain Access under iCloud
B. In System Preferences in the Profiles preference pane
C. In System Information under Restrictions
D. In the Apple menu under About This Mac

Answer 122

B. In System Preferences in the Profiles preference pane

After you’ve used MDM to push restrictions to your devices, the profile displays those restrictions. Using System Preferences, you can review the restrictions by choosing the profile containing the restrictions.

Question 123

Which profile setting can you use to prevent a managed app from backing up data in iCloud?

A. Allow iCloud Drive
B. Allow managed apps to store data in iCloud
C. Allow documents from managed sources in unmanaged destinations
D. Allow documents from unmanaged sources in managed destinations

Answer 123

B. Allow managed apps to store data in iCloud

Apple’s device management framework supports several restrictions for managing iCloud. You use this setting when you want to prevent a managed app from backing up data in iCloud.

Question 124

What is a benefit of enabling FileVault on a Mac startup volume?

A. Additional security by requiring a login password to decrypt data
B. Increased encryption by increasing the number of bits in the key from 0 to 128
C. Enhanced privacy by encoding all data sent over a Mac computer’s network connections

Answer 124

A. Additional security by requiring a login password to decrypt data

On Mac computers with Apple silicon or the T2 chip, data is always encrypted on the startup volume. Turning on FileVault provides additional security by requiring a login password to decrypt data.

Question 125

What is the purpose of a PRK?

A. To initiate an “Erase All Content and Settings” command
B. To unlock the startup disk if the user forgets their login password
C. To authorize the installation of macOS software updates and upgrades

Answer 125

B. To unlock the startup disk if the user forgets their login password

When you first turn on FileVault on an individual unmanaged Mac, you choose how you want to unlock the startup disk if the user forgets their login password: with the Apple ID they use for iCloud or with a PRK.

Question 126

When managing FileVault using MDM, which of the following is required?

A. The managed Mac must be supervised.
B. An IRK must be installed on the managed Mac.
C. A user must log in on the managed Mac using an administrator account.

Answer 126

A. The managed Mac must be supervised.

You can manage FileVault settings on Mac computers that are enrolled in, and supervised by, your MDM solution, using either Automated Device Enrollment or Device Enrollment.

Question 127

Why would you defer software updates on Apple devices?

A. To roll back an update if it’s unsuccessful
B. To verify that your organization’s iPhone and iPad devices are managed
C. To test critical apps and infrastructure before deploying the update

Answer 127

C. To test critical apps and infrastructure before deploying the update

Testing apps and infrastructure before deployment is critical.

Question 128

What is the maximum number of days that you can defer software updates on Apple devices?

A. 30
B. 60
C. 90
D. 99

Answer 128

C. 90

You can defer software updates up to 90 days.

Question 129

What payload manages the ability to install macOS beta releases?

A. Content Filter
B. Restrictions
C. Security & Privacy
D. Software Update

Answer 129

D. Software Update

Use the Software Update payload to manage the installation of macOS beta releases and automatic installation of macOS updates or app updates from the App Store.

Question 130

How can you tell if a restriction applies only to a supervised device?

A. The restriction description contains “(supervised only).”
B. The restriction displays only if a device is supervised.
C. The restriction is dimmed if the device isn’t supervised.
D. The restriction appears in the group named Supervised Restrictions.

Answer 130

A. The restriction description contains “(supervised only).”

MDM solutions indicate when a restriction applies only to supervised devices.

Question 131

Which payload do you use to configure specific rules when users create a password or passcode on their enrolled devices?

A. Passcode
B. Password
C. Restrictions
D. Security & Privacy

Answer 131

A. Passcode

You choose the Passcode payload to configure specific rules for the creation of passwords or passcodes on enrolled devices.

Question 132

Which of the following options can you configure for Gatekeeper?

A. Set accessibility and passcodes
B. Login items and macOS security
C. macOS restrictions and accessibility
D. Prevent manual override and restrict to App Store apps only

Answer 132

D. Prevent manual override and restrict to App Store apps only

You can enable Gatekeeper, restrict to App Store apps, and prevent manual override.

Question 133

What is the purpose of configuring a Passcode payload?

A. It helps retrieve a user’s passcode if the user can’t sign in for some reason.
B. It requires that users set passcodes for all apps that they use on their devices.
C. It enables your organization to change a user’s passcode remotely if a device is lost or stolen.
D. It enforces passcode rules that help prevent unauthorized access to your organization’s devices and data.

Answer 133

D. It enforces passcode rules that help prevent unauthorized access to your organization’s devices and data.

You configure a Passcode payload with specific rules users must follow when creating a device passcode or password.

Question 134

The Passcode payload configures passcode rules for iPhone and iPad devices, while the Password payload configures password rules for Mac computers.

A. True
B. False

Answer 134

B. False

The Passcode payload configures passcode rules for iPhone and iPad, as well as password rules for Mac.

Question 135

What must a user do when you install the Passcode payload on the user’s iPhone?

A. The user must enter a passcode using the specified settings within 60 minutes.
B. The user must accept the payload to permit the specified settings to take effect.
C. The user must restart the device to install the payload, and then enter a new passcode.

Answer 135

A. The user must enter a passcode using the specified settings within 60 minutes.

If the user doesn’t do so within that time frame, the payload forces the user to enter a passcode using the specified settings.

Question 136

What is the purpose of configuring a Restrictions payload for Apple devices?

A. Restrictions prevent users from unenrolling a device from MDM.
B. Restrictions prevent unauthorized users from accessing a device.
C. Restrictions prevent users from accessing a specific app, service, or function of a device.

Answer 136

C. Restrictions prevent users from accessing a specific app, service, or function of a device.

You configure a Restrictions payload to prevent access to a specific app, service, or function on a device.

Question 137

What happens if you select “(supervised only)” restriction settings for an unsupervised device?

A. The “(supervised only)” settings don’t take effect unless you have previously supervised the device.
B. The “(supervised only)” settings override any configuration the user sets on the unsupervised device.
C. The “(supervised only)” settings require you to turn on device supervision before you can save the payload.

Answer 137

A. The “(supervised only)” settings don’t take effect unless you have previously supervised the device.

You can select “(supervised only)” settings for unsupervised devices, but the settings don’t take effect unless the device is supervised.

Question 138

What happens when you select the “Allow USB accessories while device is locked (supervised only)” restriction and an iPhone or iPad device is connected to a computer with a compatible Ethernet adapter?

A. The device maintains a data connection to a connected network only when a user unlocks it.
B. The device maintains a data connection to a connected network before a user unlocks it.
C. The device automatically unlocks after an hour so that you can refresh it using MDM.

Answer 138

B. The device maintains a data connection to a connected network before a user unlocks it.

When you select the “Allow USB accessories while device is locked (supervised only)” restriction and an iPhone or iPad device is connected to a computer with a compatible Ethernet adapter, the device maintains a data connection even before a user unlocks it.

Question 139

What is required before you can manage a USB restriction?

A. Supervision
B. A Managed Apple ID
C. An unsupervised Apple device

Answer 139

A. Supervision

Both pairing restrictions in the Restrictions payload require that your iPhone and iPad devices be supervised.

Question 140

How do you ensure that only trusted host computers can pair with your organization’s iPhone and iPad devices?

A. Allow pairing with only Mac computers.
B. Distribute the correct digital certificate to users’ groups and devices.
C. Distribute the correct supervision identities to users’ devices.

Answer 140

C. Distribute the correct supervision identities to users’ devices.

When you deselect the “Allow pairing with non-Configurator hosts (supervised only)” restriction — and distribute the correct supervision identities to users’ devices — you ensure that only trusted computers holding a valid supervision host certificate are allowed to access iPhone or iPad over USB.

Question 141

Which of the following can you use to distribute a certificate identity to a device in a configuration profile?

A. A .p12 file
B. A PKI token
C. An MD5 hash file

Answer 141

A. A .p12 file

You can put a certificate identity into a PKCS #12 file protected with a password, and push the file to the device in a configuration profile.

Question 142

When you compose a Mail message on a managed Apple device, what happens when Mail finds the certificate for a recipient email?

The user is asked to choose a certificate to sign the message.

A “Sign this message” option appears left of the “To:” field.

A lock icon appears to the right of the recipient’s contact name, and the address text is blue.

Answer 142

A lock icon appears to the right of the recipient’s contact name, and the address text is blue.

Mail consults the GAL to discover the recipient’s S/MIME certificate. When Mail finds the certificate for your recipient, a lock icon appears to the right of the recipient’s contact name, and the address text is blue.

Question 143

What do managed Apple devices require to send signed messages in Mail using S/MIME?

A. Your email address must be in the recipient’s GAL.
B. You must have your identity’s private key in your keychain.
C. Recipients must have your identity’s private key in their keychains.

Answer 143

B. You must have your identity’s private key in your keychain.

Private keys are important for signing messages in Mail. To send signed messages in Mail using S/MIME on a managed Apple device, you must have your identity’s private key in your keychain.

Question 144

What do managed Apple devices require to send encrypted messages in Mail using S/MIME?

A. The public key from the recipient’s certificate
B. An encryption extension in the recipient’s certificate
C. A restriction payload with the “Allow sending encrypted messages using S/MIME” setting selected

Answer 144

A. The public key from the recipient’s certificate

Public keys are important for encrypting messages in Mail. To send encrypted messages in Mail using S/MIME on a managed Apple device, you must have the public key from the recipient’s certificate in your keychain.

Question 145

What happens when you use Safari on iPhone or iPad to visit a site with a revoked certificate?

A. You are asked to delete the certificate.
B. You are directed to the CA’s website to update the certificate.
C. “This Connection Is Not Private” appears instead of the contents of the site.

Answer 145

C. “This Connection Is Not Private” appears instead of the contents of the site.

When you use Safari on iPhone or iPad to visit a site with a revoked certificate, “This Connection Is Not Private” appears instead of the contents of the site.

Question 146

Which prioritization method ensures that the most important app data always gets the best possible bandwidth, even if the network is congested with other traffic?

A. Proxies
B. Restrictions
C. Fastlane QoS marking

Answer 146

C. Fastlane QoS marking

Fastlane QoS marking ensures that the most important app data always gets the best possible bandwidth.

Question 147

What is the main benefit of using a proxy server on your network?

A. The ability to encrypt content
B. The ability to specify how managed apps use cellular data
C. The ability to filter content or manage available bandwidth

Answer 147

C. The ability to filter content or manage available bandwidth

You can use a proxy server to control the routing of traffic between your local intranet and the internet.

Question 148

Which MDM payload contains the settings that specify how managed apps use cellular data?

A. Cellular
B. Proxy server
C. Content Caching
D. Network Usage Rules

Answer 148

D. Network Usage Rules

You can configure the Network Usage Rules payload settings to specify how managed apps use cellular data.

Question 149

Which MDM payload contains the settings that enable QoS support on your managed devices?

A. Wi-Fi
B. Proxy
C. Content Caching
D. Network Usage Rules

Answer 149

A. Wi-Fi

Apps with enabled QoS support automatically take priority over low-priority apps such as those used for syncing documents in the background.

Question 150

Where do you add allowed apps?

A. The Security Type pop-up menu
B. The Restrict Fast Lane QoS Marking pop-up menu
C. The Proxy Setup pop-up menu

Answer 150

B. The Restrict Fast Lane QoS Marking pop-up menu

The Restrict Fast Lane QoS Marking pop-up menu leads to the option of searching the App Store for apps to allow.

Question 151

Which is a requirement for QoS prioritization?

A. The network service type
B. Accurate proxy settings
C. The QoS app

Answer 151

A. The network service type

The developer must mark the network service type for QoS to use it.

Question 152

Which payload do you use to set QoS priorities?

A. Wi-Fi
B. Network
C. Certificate
D. Restrictions

Answer 152

B. Network

You set QoS priorities with a Network payload.

Question 153

Which statement about Managed Lost Mode is true?

A. Managed Lost Mode requires Find My to be turned on.
B. You can use MDM to put an unsupervised iPhone or iPad device into Managed Lost Mode.
C. MDM remotely queries a lost device for its location the last time that the device was online.

Answer 153

C. MDM remotely queries a lost device for its location the last time that the device was online.

With Managed Lost Mode, you can find a supervised iPhone or iPad device that is lost or stolen because the MDM solution remotely queries for its location when the device connects to a network that both the managed device and the MDM solution can access.

Question 154

What can you do when you use your MDM solution to enable Lost Mode on a device?

A. You can customize the Lock Screen with a message, add a contact phone number, and include a note.
B. You can customize the Lock Screen with a bypass code, add a contact phone number, and include a note.
C. You can customize the Lock Screen with only a contact phone number and a message.

Answer 154

A. You can customize the Lock Screen with a message, add a contact phone number, and include a note.

When you enable Lost Mode on a device, you can customize the Lock Screen with a message, a contact phone number, and a note.

Question 155

Which of these statements is true?

A. When an MDM solution remotely disables Managed Lost Mode, it locks the device. It also notifies the user upon locking the device screen that the MDM solution enabled Managed Lost Mode and collected the device’s location.

B. You can use your MDM solution to issue commands to disable Lost Mode on an unmanaged iPhone or iPad device.

C. You can disable Lost Mode if it’s erroneously enabled or enabled on a retrieved device.

Answer 155

C. You can disable Lost Mode if it’s erroneously enabled or enabled on a retrieved device.

You can disable Lost Mode if it’s erroneously enabled or enabled on a retrieved device.

Question 156

Using your MDM solution, you enabled Lost Mode for a lost iPad. The next day, the verified user recovered the device, and you disabled Lost Mode.

What notification does the user see when they unlock their iPad?

A. MDM enabled Managed Lost Mode and collected the device location.
B. MDM disabled Managed Lost Mode and Activation Lock.
C. MDM enabled recovery mode and restored the device data and settings.

Answer 156

A. MDM enabled Managed Lost Mode and collected the device location.

When an MDM solution administrator remotely disables Managed Lost Mode, the user sees a message that the device was locked and the MDM solution collected its location.

Question 157

What happens when you use your MDM solution to remotely disable Lost Mode?

A. It removes the Lost Mode profile.
B. It wipes the device remotely.
C. It unlocks the device.

Answer 157

C. It unlocks the device.

When you use your MDM solution to remotely disable Lost Mode, it unlocks the device, collects its location, and notifies the user that Lost Mode is disabled.

Question 158

What happens when you enable Lost Mode for a missing device?

A. MDM locks the device.
B. MDM wipes the device remotely.
C. MDM issues a bypass code.

Answer 158

A. MDM locks the device.

When you enable Lost Mode for a missing device with your MDM solution, it locks the device, displays your custom message, and determines the device location.

Question 159

What happens if Find My is enabled for a managed device and your MDM solution allows Activation Lock?

A. Activation Lock is enabled.
B. The device is locked, and its location is collected.
C. The user is notified that Activation Lock is enabled.

Answer 159

A. Activation Lock is enabled.

If Find My is enabled when your MDM solution allows Activation Lock on managed devices, Activation Lock is automatically enabled at that point.

Question 160

What happens if Find My is disabled for a managed device when your MDM solution allows Activation Lock?

A. Activation Lock is enabled at that point.
B. The device is locked, and its location is collected.
C. The user is notified that Activation Lock is disabled.
D. Activation Lock is enabled the next time that the user enables Find My.

Answer 160

D. Activation Lock is enabled the next time that the user enables Find My.

If Find My is disabled when your MDM solution allows Activation Lock on managed devices, Activation Lock is enabled the next time that the user enables Find My.

Question 161

Your organization decides that to deter thefts, the organization-owned iPad and iPhone devices must have Activation Lock on and be managed using an MDM solution.

Which initial configuration would you use to enforce Activation Lock for the supervised devices with an MDM solution?

A. Allow Activation Lock
B. Allow Activation Lock only if a bypass code is available.
C. Enable Activation Lock

Answer 161

C. Enable Activation Lock

When an MDM solution enables Activation Lock, the user can’t disable Activation Lock. The organization uses the MDM solution, which interacts directly with Apple servers to enable or disable Activation Lock.

Question 162

Your organization wants to encourage users to set Activation Lock to deter thefts of supervised iPad and iPhone devices and Mac computers. However, the organization also needs to manage Activation Lock if users can’t access their devices.

Which initial Activation Lock configuration achieves this setup with an MDM solution?

A. Allow Activation Lock
B. Allow Activation Lock only if a bypass code is available.
C. Enable Activation Lock

Answer 162

B. Allow Activation Lock only if a bypass code is available.

The organization’s MDM solution can disable Activation Lock with the bypass code, without user interaction.

Question 163

If Activation Lock is turned on for a wiped iPhone, you can turn off Activation Lock with a bypass code.

A. True
B. False

Answer 163

A. True

You can turn off Activation Lock to prepare the device for reuse.

Question 164

What happens when you use MDM to wipe a Mac?

A. The keys in Effaceable Storage are deleted, and user data is cryptographically inaccessible.
B. User settings are saved.
C. You must reinstall macOS.
D. A disk image of user data is saved.

Answer 164

A. The keys in Effaceable Storage are deleted, and user data is cryptographically inaccessible.

After you remotely wipe a Mac, the keys in Effaceable Storage are deleted, and user data is cryptographically inaccessible.

Question 165

What happens when you use an MDM solution to wipe iPhone?

A. Wiping iPhone or iPad restores the device to its factory settings while preserving the last installed iOS or iPadOS version.

B. Wiping iPhone automatically backs up user data and settings to iCloud before restoring factory settings.

C. Wiping iPhone puts the device in recovery mode, and you must reinstall iOS.

Answer 165

A. Wiping iPhone or iPad restores the device to its factory settings while preserving the last installed iOS or iPadOS version.

Wiping iPhone or iPad removes all user data and settings and restores factory settings, preserving the last installed iOS or iPadOS version.

Question 166

Where do you enter the Activation Lock bypass code on a wiped iPhone or iPad?

A. On the Activation Lock screen in Setup Assistant, you enter the bypass code in the Apple ID field.
B. On the Activation Lock screen in Setup Assistant, you enter the bypass code in the Passcode field.
C. On the Activation Lock screen in Setup Assistant, tap Activation Lock Help, and enter the bypass code when asked.
D. On the Activation Lock screen in Setup Assistant, enter the bypass code in the Apple ID field and the device passcode in the Passcode field.

Answer 166

B. On the Activation Lock screen in Setup Assistant, you enter the bypass code in the Passcode field.

You enter the bypass code in the Passcode field.

Question 167

Which type of query can you use to list all installed apps on a device?

A. Device
B. Device network
C. Security

Answer 167

A. Device

Device queries return specific information about a device, such as apps installed.

Question 168

When is information about a managed device updated in an MDM solution?

A. When the user completes Setup Assistant
B. Every time the device connects to the network
C. Every time the device contacts the MDM solution
D. According to the settings in the management profile installed on the device

Answer 168

C. Every time the device contacts the MDM solution

MDM solutions update device information when a device contacts the MDM solution. Typically, devices contact the MDM solution when they receive an APNs notification to check in with the MDM solution.

Question 169

Someone turns in a managed iPhone that was purchased from a reseller other than Apple or participating Apple Authorized Resellers or carriers.

Which tool do you use to add it your organization’s Apple Business Manager or Apple School Manager account?

A. Apple Configurator for Mac
B. Apple Configurator for iPhone
C. startosinstall

Answer 169

A. Apple Configurator for Mac

You use Apple Configurator for Mac to assign iPhone, iPad, or Apple TV to your organization in Apple Business Manager or Apple School Manager.

Question 170

A user turns in an iPhone device and a Mac. Both have managed apps installed. You use your MDM solution to erase the content and settings and disable Activation Lock, then revoke the app licenses.

Can you immediately reassign the app licenses?

A. Yes
B. No

Answer 170

A. Yes

You can reassign revoked licenses for managed apps to other users or devices.

Question 171

Where can you find the startosinstall tool?

A. In the App Store
B. In Apple Configurator
C. In the macOS Installer package bundle
D. In /Applications/Utilities on your Mac

Answer 171

C. In the macOS Installer package bundle

startosinstall is located inside the macOS installer’s Contents and Resources folder.

Question 172

You’re writing a startosinstall script to prepare Mac computers for redeployment and need to install multiple packages. Some packages depend on other packages already being installed.

A. What’s the best way to ensure that packages are installed in a specific order with –installpackage?

B. Use a loop, and call startosinstall multiple times with different –installpackage arguments for each package in order.

C. Write separate startosinstall commands with –installpackage for each package, and specify a –rebootdelay.

D. Determine the necessary sequence, and call startosinstall with multiple –installpackage arguments for each package in order.

Answer 172

D. Determine the necessary sequence, and call startosinstall with multiple –installpackage arguments for each package in order.

–installpackage installs all packages passed to it in the order in which they’re passed to the command.

Question 173

Your organization retires six iPhone devices and turns them in for credit toward new devices through the Apple Trade In program. Three of the iPhone devices aren’t eligible for credit. What happens to those devices?

A. Apple recycles the devices.
B. Apple ships the devices back to you.
C. Apple deducts a recycling fee from your credit.
D. Apple ships the devices to the recycling facility of your choice.

Answer 173

A. Apple recycles the devices.

Apple recycles the devices through its recycling partners.

Question 174

What happens to trade-in devices that Apple receives through the Apple Trade In program?

A. Apple refurbishes and resells all devices.
B. Apple sends all devices to its recycling partners.
C. Apple refurbishes devices that are in good shape and recycles the rest.

Answer 174

C. Apple refurbishes devices that are in good shape and recycles the rest.

Apple refurbishes reusable devices.

Question 175

You should first back up devices and erase all content and settings before redeploying or recycling them. If you are recycling devices, you must then release them from management in Apple Business Manager or Apple School Manager and remove them from your MDM solution.

A. True
B. False

Answer 175

A. True

You don’t have to, but you should wipe your devices first, then you can release them from management in Apple Business Manager or Apple School Manager and remove them from MDM.