I85PREP
⌘ K
Apple Deployment & Mgmt study materials
Apple Deployment & Mgmt study resources

Apple Deployment & Mgmt practice questions

One question at a time. Build your Apple Deployment & Mgmt understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deployment

Which Apple service is used to automatically enroll newly purchased Mac computers into an organization's mobile device management solution?

  1. iCloud Drive
  2. Apple Configurator
  3. Xcode Server
  4. Apple Business Manager Correct answer.

Explanation

Apple Business Manager (and Apple School Manager) links an organization's purchases to a device management service so devices are automatically assigned and enrolled at first setup. Apple Configurator is a manual, cable-based tool and does not provide purchase-based automatic assignment.

Question 2Deployment

What is the purpose of the Setup Assistant during the first boot of a Mac?

  1. It registers the device with AppleCare
  2. It guides the user through initial configuration such as language, Apple ID, and account creation Correct answer.
  3. It installs the latest macOS update from the internet
  4. It encrypts the startup disk with FileVault automatically

Explanation

Setup Assistant runs on first boot and walks the user through initial configuration steps like language, network, Apple ID, and local account creation. It is the phase where enrollment profiles and MDM payloads are applied during automated device enrollment.

Question 3Deployment

Which type of enrollment gives an organization the most management control over an iPhone, including the ability to apply restrictions and remotely wipe it?

  1. User enrollment (BYOD)
  2. Device enrollment (supervised) Correct answer.
  3. Manual profile installation
  4. Account-driven enrollment without supervision

Explanation

Supervised device enrollment provides the broadest management capabilities, including applying restrictions, enforcing policies, and remote wipe. User enrollment is designed for BYOD and deliberately limits what the organization can see and control.

Question 4Deployment

Which tool is commonly used to create and apply configuration profiles to Apple devices without an MDM server?

  1. Terminal
  2. Activity Monitor
  3. Apple Configurator Correct answer.
  4. Disk Utility

Explanation

Apple Configurator can create, edit, and apply configuration profiles directly to connected devices via USB, making it useful for small deployments or testing without an MDM. The other tools are system utilities unrelated to profile management.

Question 5Deployment

What does the Volume Purchase Program (VPP) primarily allow an organization to do?

  1. Lease Mac computers on a monthly basis
  2. Acquire and distribute apps and books to managed devices or users Correct answer.
  3. Purchase hardware at education discounts
  4. Obtain extended AppleCare coverage

Explanation

VPP lets organizations buy apps and books in volume and distribute them to managed devices or users through Apple Business Manager and MDM. It concerns software licenses, not hardware purchasing or support contracts.

Question 6Deployment

Which Apple feature lets an administrator lock a supervised device to a single app for kiosk use?

  1. Single App Mode Correct answer.
  2. Do Not Disturb
  3. Guided Access
  4. Screen Time

Explanation

Single App Mode, configurable via a configuration profile or MDM, restricts a supervised device to one app for kiosk scenarios. Guided Access is a user-level accessibility feature on iOS/iPadOS, and Screen Time and Do Not Disturb are unrelated to kiosk lockdown.

Question 7Deployment

Which macOS feature allows an administrator to create a standardized user home folder template for new local accounts?

  1. Recovery Mode
  2. Firmware Password Utility
  3. User Template in /System/Library/User Template Correct answer.
  4. Time Machine

Explanation

macOS uses the User Template directory to populate new local accounts, so customizing it standardizes new user home folders. The other features relate to security, recovery, and backup rather than account provisioning.

Question 8Deployment

What is the primary role of a bootstrap token in macOS device management?

  1. It enables secure automated user account creation and FileVault handling on managed Macs Correct answer.
  2. It unlocks the firmware password during boot
  3. It authorizes software purchases in Apple Business Manager
  4. It encrypts network traffic between the Mac and the MDM server

Explanation

The bootstrap token is a secure credential that lets MDM perform privileged operations such as creating admin accounts and managing FileVault on macOS. It is not a network encryption mechanism, firmware unlock, or purchasing authorization.

Question 9Deployment

An organization wants new iPhones purchased through Apple to be automatically assigned to their MDM server before the devices are unboxed. Which step must be completed first?

  1. The organization must link its Apple Business Manager account to its MDM server Correct answer.
  2. The devices must be wiped and re-enrolled after setup
  3. The devices must be manually connected to Apple Configurator
  4. Each device must be enrolled by the user via a profile

Explanation

Automatic assignment requires linking the organization's Apple Business Manager account to the MDM server so purchase records can be assigned. Once linked, devices are assigned and enrolled at Setup Assistant. Manual Configurator steps or user-driven enrollment are not required.

Question 10Deployment

A technician needs to skip specific Setup Assistant panes on supervised devices during deployment. What is the correct approach?

  1. Apply a configuration profile that defines which Setup Assistant panes to skip Correct answer.
  2. Disable Setup Assistant in Recovery Mode
  3. Use Disk Utility to bypass the panes
  4. Edit the device's plist file manually after setup

Explanation

A configuration profile can specify which Setup Assistant panes to skip on supervised devices, streamlining deployment. Manual plist edits, Recovery Mode, and Disk Utility do not provide this control.

Question 11Deployment

Which enrollment method is best suited for personally owned employee iPhones where the organization must not see personal data?

  1. Apple Configurator supervision
  2. User enrollment Correct answer.
  3. Supervised device enrollment
  4. Automated device enrollment

Explanation

User enrollment is designed for BYOD: it separates work and personal data and limits organizational visibility. Supervised and automated enrollment provide deeper control appropriate for organization-owned devices.

Question 12Deployment

A configuration profile contains a Wi-Fi payload set to install automatically. What determines whether the profile can be removed by the user?

  1. The user's iCloud account status
  2. The version of the Wi-Fi router firmware
  3. The profile's removal password setting and whether it is installed via MDM Correct answer.
  4. The device's storage capacity

Explanation

Whether a profile can be removed depends on settings such as a removal password and whether it was installed through MDM, which can mark it non-removable. Storage, router firmware, and iCloud status do not control profile removability.

Question 13Deployment

An admin wants to distribute a purchased app to 50 iPads without requiring each user to sign in with an Apple ID. Which mechanism should be used?

  1. Ask each user to redeem a promo code
  2. Install the app from the App Store manually on each device
  3. Email the app IPA to each user
  4. Assign the app license to devices through Apple Business Manager and push it via MDM Correct answer.

Explanation

Device-based license assignment through Apple Business Manager, combined with MDM, installs apps without per-user Apple IDs. Promo codes, emailed IPAs, and manual App Store installs do not scale and often require user credentials.

Question 14Deployment

Which statement about the relationship between supervision and MDM is accurate?

  1. Supervision prevents any MDM management
  2. MDM enrollment automatically supervises all devices
  3. Supervision is required for every MDM enrollment
  4. Supervision enables additional MDM controls but is not required for basic management Correct answer.

Explanation

Supervision unlocks additional management capabilities but is not a prerequisite for basic MDM enrollment. Devices can be enrolled in MDM without supervision, though with fewer controls.

Question 15Deployment

A Mac must be enrolled in MDM and have FileVault enabled with the recovery key escrowed to the server. Which sequence is correct?

  1. Enable FileVault manually, then enroll the Mac
  2. Enroll the Mac in MDM, then push a FileVault payload to escrow the key Correct answer.
  3. Disable FileVault, then enroll the Mac
  4. Escrow the key first, then install macOS

Explanation

FileVault recovery key escrow requires MDM enrollment first so the server can issue the FileVault payload and receive the key. Manual enabling, pre-escrow, or disabling FileVault do not achieve escrow.

Question 16Deployment

Which Apple Business Manager role is required to assign devices to an MDM server?

  1. A user with the People Manager role only
  2. A user with the Administrator or Device Enrollment Manager role Correct answer.
  3. Any user with a managed Apple ID
  4. A user with the Device Enrollment Manager role

Explanation

Assigning devices to an MDM server requires administrative privileges such as the Administrator or Device Enrollment Manager role in Apple Business Manager. Managed Apple IDs and People Manager roles lack this authority.

Question 17Deployment

An organization wants to ensure that a Mac's startup disk is encrypted and that the user cannot disable FileVault. What should the administrator configure?

  1. A Screen Time restriction
  2. A firmware password only
  3. A FileVault payload in a configuration profile that enforces encryption Correct answer.
  4. A separate local admin account for each user

Explanation

A FileVault payload in a configuration profile enforces encryption and prevents the user from disabling it. A firmware password, Screen Time, or extra admin accounts do not enforce FileVault.

Question 18Deployment

Which mechanism allows an MDM server to install a configuration profile on a Mac without user interaction after enrollment?

  1. An email with a .mobileconfig attachment
  2. A manual download from the App Store
  3. An MDM install command over the device management channel Correct answer.
  4. A push notification prompting the user to accept

Explanation

After enrollment, MDM can send install commands over the management channel to apply profiles without user interaction. Push prompts, email attachments, and App Store downloads require user action.

Question 19Deployment

A company uses Apple Configurator to supervise iPads. Which capability becomes available that is unavailable on unsupervised devices?

  1. Using FaceTime
  2. Sending text messages
  3. Installing apps from the App Store
  4. Restricting the use of the camera and blocking app removal Correct answer.

Explanation

Supervision enables restrictions such as disabling the camera and preventing app removal, which are not available on unsupervised devices. App installation, messaging, and FaceTime are general features available regardless of supervision.

Question 20Deployment

An organization must ensure that only approved apps run on supervised iPads and that users cannot install others. Which configuration should be applied?

  1. Enable Screen Time content restrictions only
  2. Set the App Store to allowed but restrict app installation to MDM-assigned apps Correct answer.
  3. Allow only the App Store and block in-app purchases
  4. Disable the camera

Explanation

Restricting app installation to MDM-assigned apps on supervised devices ensures only approved apps are present. Allowing the App Store, Screen Time-only restrictions, or disabling the camera do not prevent unapproved app installs.

Question 21Deployment

Which statement best explains why automated device enrollment is preferred over manual profile installation for large fleets?

  1. It allows devices to bypass Setup Assistant entirely
  2. It applies enrollment at first boot and reduces manual steps and user error Correct answer.
  3. It eliminates the need for an MDM server
  4. It prevents the device from ever being wiped

Explanation

Automated device enrollment applies management at first boot, reducing manual steps and user error across large fleets. It still requires an MDM server, does not prevent wiping, and does not bypass Setup Assistant.

Question 22Deployment

A Mac enrolled via automated device enrollment has a bootstrap token, but the MDM server reports it cannot create an admin account. Which is the most likely cause?

  1. The Mac is running an outdated version of Safari
  2. The bootstrap token has not been escrowed to the MDM server Correct answer.
  3. The Wi-Fi network is using WPA3
  4. The Mac has too many user accounts

Explanation

Privileged operations such as admin account creation require the bootstrap token to be escrowed to the MDM server. An unescrowed token prevents these operations regardless of browser version, account count, or Wi-Fi security.

Question 23Deployment

An admin wants to prevent users from erasing and re-enrolling supervised iPads outside organizational control. Which control is most effective?

  1. Enabling Find My iPad
  2. Applying a restriction that prevents account changes and device erasure Correct answer.
  3. Setting a passcode length requirement
  4. Enabling automatic app updates

Explanation

Supervised devices can receive restrictions that prevent account changes and device erasure, keeping them under organizational control. Find My, passcode length, and app updates do not prevent erasure and re-enrollment.

Question 24Deployment

Which Apple Business Manager capability supports assigning apps to specific users rather than devices?

  1. Device-based license assignment
  2. Promo code redemption
  3. Family Sharing
  4. User-based license assignment through managed Apple IDs Correct answer.

Explanation

User-based license assignment ties app licenses to managed Apple IDs, allowing apps to follow users across devices. Device-based assignment ties licenses to hardware, and promo codes or Family Sharing are not enterprise assignment methods.

Question 25Deployment

An organization wants to enforce a minimum macOS version on managed Macs and defer software updates. Which combination is appropriate?

  1. A configuration profile with software update deferral settings plus MDM update commands Correct answer.
  2. A Screen Time passcode plus Guided Access
  3. An iCloud backup plus Time Machine
  4. A firmware password plus Disk Utility

Explanation

Software update deferral is configured through a profile, and MDM commands can enforce or schedule updates. Firmware passwords, Screen Time, and backup tools do not control OS version enforcement.

Question 26Deployment

Which Apple service is the authoritative source that associates a device's serial number with an organization's MDM server for automated enrollment?

  1. Apple Schoolwork Manager
  2. Apple Push Notification service
  3. Apple Business Manager Correct answer.
  4. Apple Configurator

Explanation

Apple Business Manager holds the device-to-MDM assignment that a Mac or iOS device checks during Setup Assistant. The push service only delivers MDM commands and does not store device ownership records.

Question 27Deployment

What does a Mac download during Setup Assistant when it is assigned to an MDM server in Apple Business Manager?

  1. A full disk image of the organization's standard build
  2. An enrollment profile that points it to the MDM server Correct answer.
  3. A one-time Apple ID tied to the organization
  4. A signed kernel extension bundle

Explanation

Automated device enrollment delivers a profile containing the MDM enrollment URL and related settings so the device contacts the server without manual profile installation. It does not deliver OS images or Apple IDs.

Question 28Deployment

Which certificate must be valid for an MDM server to send commands to enrolled devices through APNs?

  1. An Apple-issued MDM push certificate Correct answer.
  2. A public TLS certificate from any CA
  3. A developer provisioning profile
  4. A code-signing certificate issued to the organization

Explanation

The MDM server authenticates to APNs using an Apple-issued push certificate tied to the organization's MDM push identity. Renewing it before expiry is a routine operational task.

Question 29Deployment

Which enrollment path requires the user to install a profile manually after signing in with a managed Apple Account on an unassigned device?

  1. Profile-based enrollment initiated by the user Correct answer.
  2. Apple Configurator supervision
  3. Automated device enrollment
  4. Device enrollment with account-driven flow from Apple Business Manager assignment

Explanation

When a device is not assigned in Apple Business Manager, a user can still enroll by downloading and approving an enrollment profile. Automated enrollment and Configurator supervision depend on other prerequisites.

Question 30Deployment

Which payload type is used to distribute a root certificate authority to managed Macs so internal services are trusted?

  1. Login Items payload
  2. Energy Saver payload
  3. Certificate payload Correct answer.
  4. Restrictions payload

Explanation

The certificate payload places a certificate in the system trust store on managed devices. Restrictions and other payloads govern behavior rather than trust anchors.

Question 31Deployment

What is required before an iPhone can be supervised through Apple Configurator?

  1. The device must be jailbroken
  2. The device must be signed into iCloud
  3. The device must be erased and prepared by Configurator Correct answer.
  4. The device must have a passcode set

Explanation

Configurator prepares a device by erasing it and applying a supervision identity, so existing content is removed. Supervision cannot be added to an in-use device without that preparation step.

Question 32Deployment

Which item does an administrator generate in Apple Business Manager so that apps and books can be assigned to devices or users?

  1. A bootstrap token
  2. A supervision identity
  3. A volume purchase certificate file
  4. A location-based content token Correct answer.

Explanation

Content purchased through Apple Business Manager is delivered using a server token tied to a location. The token authorizes the MDM server to request licenses for that location's content.

Question 33Deployment

Which Apple program allows an organization to obtain custom apps built for internal use and distribute them through its MDM server?

  1. Apple Business Manager custom apps Correct answer.
  2. Apple Developer Enterprise Program ad hoc distribution
  3. Mac App Store public listings
  4. TestFlight external testing

Explanation

Custom apps are requested through Apple Business Manager and delivered to assigned devices or users via MDM. They are not published publicly.

Question 34Deployment

An administrator must enroll a Mac that was purchased before the organization joined Apple Business Manager. Which approach adds it to the organization's device records?

  1. Reinstall macOS from a USB installer
  2. Use Apple Configurator to add the device to Apple Business Manager Correct answer.
  3. Sign the Mac into iCloud with a managed Apple Account
  4. Install a configuration profile from email

Explanation

Apple Configurator can add eligible devices to Apple Business Manager so they can later be assigned to an MDM server. Reinstalling the OS or signing in does not create the ownership record.

Question 35Deployment

What does the Await Device Configured command allow an MDM server to do on a supervised device?

  1. Erase only the data partition
  2. Hold the device at the remote management pane until the server releases it Correct answer.
  3. Force the device into recovery mode
  4. Remotely unlock the device with a bypass code

Explanation

Await Device Configured pauses Setup Assistant after enrollment so the server can finish applying configuration before the user proceeds. It does not erase or unlock the device.

Question 36Deployment

Which condition must be met for a Mac to receive an institutional recovery key escrowed by MDM when FileVault is enabled?

  1. The Mac must be running the latest beta of macOS
  2. The Mac must have a single local account
  3. The Mac must be supervised and managed Correct answer.
  4. The Mac must be bound to Active Directory

Explanation

Escrowing FileVault keys through MDM requires the device to be managed and, for full control, supervised. Beta status, account count, and directory binding are not requirements.

Question 37Deployment

An administrator wants to prevent a supervised iPad from being erased by the user while still allowing the organization to erase it remotely. Which setting is used?

  1. Disallow erase in the Restrictions payload Correct answer.
  2. Enable Lost Mode
  3. Set a passcode complexity requirement
  4. Enable Shared iPad

Explanation

The Restrictions payload can block user-initiated erase on supervised devices while MDM commands remain available to administrators. Lost Mode, passcode rules, and Shared iPad serve different purposes.

Question 38Deployment

Which statement describes how a bootstrap token is obtained on a Mac enrolled through automated device enrollment?

  1. It is retrieved from the Secure Enclave by a kernel extension
  2. It is generated only when the user enables FileVault
  3. It is issued during enrollment and can be escrowed to the MDM server Correct answer.
  4. It is created by the local administrator account at first login

Explanation

Automated enrollment supplies a bootstrap token that the MDM server can escrow and later use for privileged operations such as approving kernel extensions. It is not tied to FileVault or a specific local account.

Question 39Deployment

An organization needs devices to be supervised without touching each unit by hand. Which combination achieves this at scale?

  1. Signing each device into iCloud with a managed Apple Account
  2. Manual profile installation by each user
  3. Automated device enrollment with a server that marks devices supervised Correct answer.
  4. Apple Configurator run on each device individually

Explanation

Devices assigned in Apple Business Manager become supervised when enrolled through a server that supports supervision, avoiding manual handling. Manual profile installation and per-device Configurator runs do not scale.

Question 40Deployment

Which MDM capability depends on the device being supervised rather than merely managed?

  1. Receiving an APNs push notification
  2. Reporting the device serial number
  3. Applying a web content filter that the user cannot disable Correct answer.
  4. Installing a user-approved configuration profile

Explanation

Enforced web content filtering is a supervised-only capability. Push notifications, user-approved profiles, and basic inventory reporting work on managed devices without supervision.

Question 41Deployment

What is the effect of the Activation Lock bypass code stored by an MDM server?

  1. It disables the device's Secure Enclave
  2. It decrypts the FileVault volume
  3. It allows the organization to clear Activation Lock on a supervised device Correct answer.
  4. It unlocks the device passcode for the user

Explanation

For supervised devices, the server can store a bypass code that clears Activation Lock so the device can be redeployed. It does not reveal passcodes or affect encryption keys.

Question 42Deployment

An administrator must ensure that a supervised iPhone always uses a specific Wi-Fi network and cannot join others. Which approach is correct?

  1. Deploy a VPN payload only
  2. Ask users to forget other networks manually
  3. Enable Personal Hotspot for all users
  4. Deploy a Wi-Fi payload with the network configured and use restrictions to prevent changes Correct answer.

Explanation

A Wi-Fi payload supplies the required network, and restrictions on supervised devices can limit the user's ability to modify those settings. Manual user action and unrelated payloads do not enforce the requirement.

Question 43Deployment

Which Apple Business Manager role has the authority to assign devices to an MDM server?

  1. Personnel Manager
  2. Administrator Correct answer.
  3. Content Manager
  4. Device Enroller

Explanation

Device assignment to an MDM server is an administrative function in Apple Business Manager. Other roles are scoped to tasks such as enrollment, content, or personnel records.

Question 44Deployment

An organization wants to push a mandatory app to supervised iPads with no user prompt. Which delivery method is appropriate?

  1. An enterprise-signed IPA installed by the user
  2. An App Store link posted on the intranet
  3. A managed app installed via MDM using an Apple Business Manager license Correct answer.
  4. A redemption code emailed to each user

Explanation

MDM can install managed apps silently on supervised devices using licenses from Apple Business Manager. Redemption codes, links, and user-installed IPAs require user action.

Question 45Deployment

Which practice best protects continuity of MDM command delivery across certificate renewals?

  1. Rotate the push certificate every month
  2. Delete and recreate the MDM server entry in Apple Business Manager
  3. Renew the APNs push certificate before it expires and keep the topic identifier consistent Correct answer.
  4. Disable APNs and rely on device polling

Explanation

Renewing the push certificate ahead of expiry while preserving the topic keeps enrolled devices reachable. Frequent rotation or recreating the server entry disrupts enrollment.

Question 46Deployment

A Mac enrolled via automated device enrollment shows no bootstrap token on the server. Which action is most likely to resolve the issue?

  1. Remove the Restrictions payload
  2. Re-enroll the Mac so the token is issued and escrowed again Correct answer.
  3. Disable FileVault on the Mac
  4. Reset the PRAM

Explanation

The bootstrap token is issued at enrollment, so a device that never escrowed one generally needs to be re-enrolled. FileVault, restrictions, and firmware resets do not create the token.

Question 47Deployment

Which statement best explains why user-approved MDM enrollment on macOS differs from automated device enrollment?

  1. User-approved enrollment cannot install configuration profiles
  2. User-approved enrollment always results in supervision
  3. User-approved enrollment requires Apple Configurator
  4. User-approved enrollment grants management but not the full supervision-level control Correct answer.

Explanation

On macOS, user-approved enrollment gives the server management capabilities but does not confer supervision. Supervision requires automated enrollment or Configurator preparation.

Question 48Deployment

An administrator must ensure that a supervised iPad cannot be re-enrolled to a different MDM server after erasure. Which control addresses this?

  1. A web clip to the organization's intranet
  2. Enrollment restrictions that prevent removal of the MDM profile and limit pairing Correct answer.
  3. A VPN payload with always-on settings
  4. A passcode complexity requirement

Explanation

On supervised devices, restrictions can block profile removal and limit pairing so the device stays under organizational control. Passcode rules, VPN, and web clips do not prevent re-enrollment elsewhere.

Question 49Deployment

Which sequence correctly enables silent installation of a purchased app on supervised devices using Apple Business Manager?

  1. Enable Shared iPad, then install the app from the App Store
  2. Assign the app in MDM, then request a content token
  3. Obtain a content token, add the app license to the location, then assign it in MDM Correct answer.
  4. Email redemption codes, then add a VPN payload

Explanation

The MDM server first needs a content token for the location and licenses for the app before it can push the managed app. Assigning before licensing leaves nothing to install.

Question 50Deployment

Which factor determines whether a configuration profile can be removed by the user on a supervised device?

  1. The macOS version installed
  2. Whether the profile was installed as a managed profile by MDM with removal restricted Correct answer.
  3. Whether the device is connected to Wi-Fi
  4. The size of the profile payload

Explanation

Profiles installed by MDM on supervised devices can be locked so users cannot remove them. Payload size, OS version, and network state do not determine removability.