DEP-2025 Apple Deployment and Management Certification Exam Questions and Answers

Custom apps, developed in-house and signed with an Apple Developer account, can be deployed through all three enrollment types: Automated Device Enrollment (ADE), Device Enrollment, and User Enrollment. ADE (option A) supports custom app distribution to supervised, organization-owned devices via MDM and Managed Distribution. Device Enrollment (option B) allows custom app installation on enrolled devices, supervised or not, through MDM. User Enrollment (option C) supports custom apps for BYOD, though with limited control over personal devices. TheApple Platform Deployment Guideconfirms that custom apps are compatible with all enrollment methods when paired with MDM, making D the correct answer.

Managed Distribution in Apple Business Manager (ABM) and Apple School Manager (ASM) enables administrators to assign apps (purchased or free) to users or devices via an MDM solution. It replaced the legacy Volume Purchase Program (VPP, option D), integrating app purchasing and distribution into ABM/ASM. Automated Device Enrollment (option A) is for device enrollment, not app assignment. User Enrollment (option C) is a BYOD enrollment type, not an app distribution feature. TheApple Business Manager User Guidedetails Managed Distribution as the mechanism for app assignment.

In Kerberos, the Ticket-Granting Ticket (TGT) is the feature that enables single sign-on (SSO). After initial authentication, the user receives a TGT from the Key Distribution Center (KDC). The TGT is then used to obtain service tickets for accessing various resources without re-authenticating, providing a seamless SSO experience. Sign in with Apple at Work & School (option A) is an Apple-specific feature, not a Kerberos component. OAuth (option B) and SAML (option D) are separate SSO protocols, not Kerberos features. TheApple Platform Security Guideexplains the TGT’s role in Kerberos SSO.

Content caching requires a Mac running macOS 10.13 (High Sierra) or later, enabling it to cache content like app updates and iCloud data for network efficiency. An MDM solution (option A) can manage caching settings but isn’t required to enable it. Supervision (option C) is unrelated, as caching is a macOS feature, not a supervision requirement. A VPN configuration (option D) doesn’t apply. TheApple Platform Deployment Guidespecifies the macOS version requirement for content caching.

The Organization ID links purchases. TheApple Business Manager User Guidestates, "Provide your Organization ID to the reseller to ensure devices are assigned to your Apple Business Manager account."

Apple Configurator, a macOS application, allows administrators to supervise Apple devices (iOS, iPadOS, tvOS) by connecting them via USB. Supervision enables additional restrictions and management capabilities (e.g., blocking app removal) beyond standard MDM. Apple Business Manager (option A) and Apple School Manager (option C) manage enrollment and content but don’t supervise devices directly. Managed Apple IDs (option D) are accounts, not supervision tools. TheApple Platform Deployment Guidehighlights Apple Configurator’s role in supervision.

Supervision is required for Managed Lost Mode. TheiOS Deployment Referencestates, "Managed Lost Mode is an MDM feature available only on supervised devices, allowing administrators to lock and locate lost devices."

The personal recovery key resets passwords. ThemacOS Security Overviewstates, "With FileVault enabled and the personal recovery key escrowed to MDM, users can use it in macOS Recovery to reset their password."

Apple Business Manager (ABM) is Apple’s web-based portal designed for IT administrators in businesses to manage device enrollment (via Automated Device Enrollment), purchase and distribute app licenses, and assign content like books. Apple School Manager (option C) serves a similar purpose but is tailored for educational institutions. Apple Configurator (option B) is a macOS app for device configuration, not a portal. There’s no “Managed Apple ID portal” (option D); Managed Apple IDs are managed within ABM or ASM. The question’s broad scope fits ABM for business contexts, as per theApple Platform Deployment Guide.

Configuration profiles enable IT administrators to manage Wi-Fi settings on a device, such as preconfiguring network SSIDs, passwords, and security protocols (e.g., WPA2 Enterprise). These profiles are deployed via MDM or manually, ensuring devices connect to approved networks. Find My (option B) and iCloud (option C) are unrelated to Wi-Fi management. MDM (option D) is the delivery mechanism, but the profiles define the settings. TheApple Platform Deployment Guidedetails Wi-Fi configuration via profiles.

MDM updates the login password only. ThemacOS Security Overviewstates, "When MDM changes the password of a secure token-enabled account, only the login password is updated; the secure token remains tied to the original password unless explicitly reset." Option C is incorrect due to this separation.

Profile Manager, a macOS tool, enables configuration profile creation and management, allowing IT administrators to define settings (e.g., Wi-Fi, security) for deployment via MDM or manually. This centralizes device configuration for organizations. Personalization (option A) is user-driven and often restricted by profiles. Network performance (option C) is unrelated, and data separation (option D) pertains to User Enrollment. The Apple Platform Deployment Guide highlights profile creation as Profile Manager’s primary benefit.

User Enrollment separates managed Keychain items. TheiOS Deployment Referencestates, "With User Enrollment, Keychain items associated with a Managed Apple ID are stored in a distinct cryptographic container." Options B, C, and D aren’t separated unless tied to managed apps.

Auto Advance skips setup. TheApple Configurator User Guidestates, "Return to Service with Auto Advance automatically progresses to the Home Screen after erasing, speeding up redeployment."

Configuration profiles allow IT administrators to manage Screen Time settings on iOS/iPadOS devices (and macOS to a lesser extent), such as setting app limits, restricting content, or enforcing downtime. These profiles are deployed via MDM or manually, aligning with organizational policies. Find My (option B) and iCloud (option C) are unrelated to Screen Time management. MDM (option D) delivers profiles, but the profiles define the settings. TheApple Platform Deployment Guidedetails Screen Time configuration via profiles.

Apple Business Manager (ABM) supports the distribution of multiple app types via Managed Distribution: custom apps (developed in-house), free apps (from the App Store), and purchased apps (bought through ABM’s Apps and Books section). This flexibility allows organizations to manage all app needs within ABM, assigning them to users or devices via MDM. Options A, B, and C are all correct individually, but D encompasses them all, aligning with ABM’s comprehensive capabilities as outlined in theApple Business Manager User Guide.

Unlisted apps require a link. TheApple Business Manager User Guidestates, "Unlisted apps are published to the App Store but are discoverable only via a direct link, often for private distribution."

Configuration profiles allow IT administrators to manage location settings on a device, such as enabling/disabling Location Services, restricting app access to location data, or enforcing privacy settings. These profiles are deployed via MDM or manually. Find My (option B) uses location for tracking but isn’t a management tool. iCloud (option C) is unrelated to location management. MDM (option D) delivers profiles, but the profiles define the settings. The Apple Platform Deployment Guide details location control via profiles.

In Apple Business Manager (ABM), the Administrator role has broad permissions, including purchasing apps and assigning devices to MDM servers. The Content Manager (option B) can manage and distribute content (e.g., apps, books) but cannot purchase apps or assign devices. The Device Enrollment Manager (option C) focuses on enrolling and assigning devices but lacks purchasing authority. The People Manager (option D) manages user accounts, not apps or devices. TheApple Business Manager User Guideoutlines the Administrator’s comprehensive responsibilities, making it the correct choice.

ADE enables supervision. TheApple Platform Deployment Guidestates, "Automated Device Enrollment automatically supervises devices during setup when linked to Apple Business Manager."

Find My requires an Apple ID (personal or Managed) to enable device tracking, remote locking, or wiping via iCloud. It’s a user-initiated feature activated in device settings, not dependent on organizational tools. An MDM solution (option A) can manage Find My settings but isn’t required to use it. Supervision (option C) enhances management but isn’t necessary for Find My. A VPN configuration (option D) is unrelated. TheApple Platform Security Guidespecifies an Apple ID as the prerequisite for Find My.

Mobile Device Management (MDM) provides IT administrators with the capability to remotely wipe a device, either fully (factory reset) or selectively (removing managed data), via commands sent over APNs. This is a core MDM feature for security and compliance. Activation Lock (option A) prevents unauthorized reactivation after a wipe but doesn’t perform the wipe. Find My (option B) allows users to wipe their own devices, not administrators. iCloud (option D) supports personal wipes via Find My, not organizational ones. TheMDM Protocol Referenceconfirms MDM’s remote wipe functionality.

Configuration profiles allow IT administrators to manage Safari settings on a device, such as disabling autofill, restricting adult content, or enforcing safe browsing. These profiles are deployed via MDM or manually, tailoring browser behavior to organizational needs. Find My (option B) and iCloud (option C) are unrelated to Safari management. MDM (option D) delivers profiles, but the profiles define the settings. The Apple Platform Deployment Guide details Safari configuration via profiles.

Apple Configurator, a macOS application, supports configuring and supervising iPads, iPhones, and other iOS/iPadOS devices, as well as Apple TVs (tvOS). It runs on a Mac, which acts as the host, but the question refers to devices it can manage, not the host platform. Options A and B are correct, and while C (Mac) isn’t typically configured by Apple Configurator, the tool’s broad compatibility with Apple devices makes D the best answer. TheApple Platform Deployment Guideconfirms its use across these device types.

Supervision, applied via Apple Configurator or ADE, enables advanced management by unlocking additional MDM capabilities, such as blocking app removal, enforcing single-app mode, or managing Activation Lock. This provides greater control for organizations. Personalization (option A) is often restricted under supervision. Network performance (option C) is unrelated, and dataseparation (option D) is a User Enrollment feature. The Apple Platform Deployment Guide highlights advanced management as supervision’s key benefit.

Lost Mode is an MDM feature that allows administrators to lock a supervised device remotely, display a custom message, and track its location (if enabled). It requires an MDM solution to issue the command via APNs, and the device must be supervised. Find My (option B) enables user-initiated Lost Mode but isn’t required for MDM’s version. iCloud (option C) isn’t a prerequisite, though it’s often enabled. A passcode (option D) enhances security but isn’t required to activate Lost Mode. TheMDM Protocol Referenceconfirms MDM’s role in Lost Mode for supervised devices.

Managed Distribution, available through Apple Business Manager (ABM) or Apple School Manager (ASM), is required to deploy books to devices using an MDM solution. Administrators purchase books in ABM/ASM, assign them to users or devices via Managed Distribution, and the MDM pushes them silently (for supervised devices) or with user consent. An Apple Developer account (option A) is for apps, not books. User acceptance (option C) may be needed for non-supervised devices but isn’t the core requirement. A VPN configuration (option D) is unrelated. TheApple Business Manager User Guideconfirms Managed Distribution for book deployment.

Administrator and People Manager roles can add Locations. TheApple Business Manager User Guidestates, "Users with the Administrator or People Manager roles have permissions to add and manage Locations in Apple Business Manager." Option D’s “Location Manager” isn’t a standard role.

The one-to-one deployment model, also referred to as personally enabled, involves assigning a single device to an individual user, allowing personalization while maintaining organizational oversight via MDM. This model is a strategic choice for organizations aiming to balance user flexibility with management control, often used in education or enterprise settings. Application Programming Interface (API) (option A) is a technical tool, not a deployment model. Over-the-air (OTA) enrollment (option B) is a method of enrolling devices, not a deployment model defining ownership or usage. TheApple Platform Deployment Guideidentifies one-to-one as a core deployment model alongside shared and BYOD scenarios.

Enrollment SSO streamlines account-driven enrollment. TheiOS Deployment Referencestates, "Enrollment SSO simplifies authentication during account-driven enrollment by allowing users to authenticate once with their Managed Apple ID across the process." Option B is incorrect as it’s not a distinct technology here.

Configuration profiles enable IT administrators to manage VPN settings on a device, specifying details like server address, protocol (e.g., IKEv2, L2TP), and authentication methods (e.g., certificates, credentials). These profiles are deployed via MDM or manually, ensuring secure network access. Find My (option B) and iCloud (option C) are unrelated to VPN management. MDM (option D) is the system that delivers profiles, but the profiles themselves contain the VPN settings. TheApple Platform Deployment Guidedetails VPN configuration via profiles.

Configuration profiles allow IT administrators to manage iCloud settings on a device, such as enabling/disabling iCloud Drive, restricting backups, or limiting document sync. These profiles are deployed via MDM or manually, providing granular control over iCloud features. Find My (option B) is a user-facing tracking feature, not a management tool. iCloud Backup (option C) is a specific iCloud service, not a management feature. MDM (option D) is the system that deploys profiles, but the profiles themselves contain the settings. TheApple Platform Deployment Guidedetails configuration profiles’ role in iCloud management.

To link a new Apple Authorized Reseller to your Apple Business Manager (ABM) or Apple School Manager (ASM) account, you must add the reseller’s Reseller Number (also known as the Apple Customer Number). TheApple Business Manager User Guidestates, "To ensure devices purchased from a new Apple Authorized Reseller appear in Apple Business Manager, add the reseller’s Reseller Number in the ‘Resellers’ section of your account settings." Option B (Organization ID) is provided to the reseller, not added in ABM/ASM, while A and C are not required for this purpose.

Configuration profiles enable IT administrators to manage app installation settings on a device, such as restricting the App Store, preventing app removal, or enforcing an allow list of approved apps. These profiles are deployed via MDM or manually, ensuring control over app usage. Find My (option B) and iCloud (option C) are user-focused features unrelated to app installation management. MDM (option D) is the delivery mechanism, but the profiles define the settings. TheApple Platform Deployment Guidedetails app installation control via configuration profiles.

Shared iPad, a feature for multi-user environments like education or business, requires devices to be supervised and enrolled via Automated Device Enrollment (ADE) through Apple School Manager (ASM) or Apple Business Manager (ABM). ADE ensures the device is pre-configured with an MDM solution that supports Shared iPad settings, such as user session management with Managed Apple IDs. Device Enrollment (option B) can supervise devices but isn’t optimized for Shared iPad’s automatic setup. User Enrollment (option C) is for BYOD and doesn’t support Shared iPad, which is for organization-owned devices. TheApple Platform Deployment Guidespecifies ADE for Shared iPad deployment.

ADE enforces OS requirements. TheApple Platform Deployment Guidestates, "When a device attempts ADE and doesn’t meet the minimum OS version specified in the MDM profile, it will download and install the required update during Setup Assistant, then resume the enrollment process automatically." Options B, C, and D don’t align with this process.

A key feature to consider in an MDM solution is its ability to integrate with an organization’s existing identity provider (IdP) or directory service (e.g., Active Directory, Azure AD, or Google Workspace). This ensures seamless user authentication, leveraging single sign-on (SSO) and existing credentials, which enhances security and user experience. Support for future OS versions (option B) is important for compatibility but not specifically an authentication feature. Support for BYOD (option C) is a deployment consideration, not an authentication feature. TheApple Platform Deployment Guidehighlights IdP integration as critical for authentication in MDM deployments.

Apple Business Manager (ABM) uses a device’s serial number to identify devices purchased from Apple or an authorized reseller for enrollment in Automated Device Enrollment (ADE). Serial numbers are unique to each device and linked to purchase records, allowing ABM to verify eligibility. Order numbers (option A) track purchases but aren’t device-specific identifiers in ABM. UDID (option C) and UUID (option D) are unique identifiers for devices or instances, but they’re not used for purchase verification in ABM. TheApple Platform Deployment Guideconfirms serial numbers as the key identifier in ABM.

AirDrop works with Shared iPad. TheiOS Deployment Referencestates, "Shared iPad supports features like AirDrop that don’t require a single user’s Apple ID, unlike Continuity features such as Universal Control or Sidecar."

The public key generates the server token. TheApple Business Manager User Guidestates, "To generate a server token for ADE, download the public key from your MDM solution and upload it to Apple Business Manager." Option C is never shared, and B and D serve different purposes.

Platform SSO syncs credentials with an IdP. ThemacOS Security Overviewstates, "Platform SSO allows users to synchronize their local Mac account password with an identity provider, providing a seamless login experience." Option B is a separate feature, C is managed via ABM, and D is unrelated to Platform SSO.

FileVault encryption requires authentication. ThemacOS Security Overviewstates, "When FileVault is enabled, macOS Recovery requires a FileVault-enabled user account and password to decrypt thedisk." Option D (Recovery Lock) uses a separate password, not user selection.

Licenses can only transfer within an organization. TheApple Business Manager User Guidestates, "Licenses can be transferred between locations, but both the sending and receiving locations must belong to the same organization in Apple Business Manager." Option D is false as licenses must be unassigned first.

Activations store values. TheMobile Device Management Protocol Referencestates, "Declarative Device Management uses Activations declarations to store values on a device, enabling proactive state management."

Mobile Device Management (MDM) enables remote management of devices, allowing administrators to deploy profiles, push apps, enforce policies, and perform actions like wiping or locking devices over the internet via APNs. Personalization (option A) is user-driven and often limited by MDM. Network performance (option C) is enhanced by other features like content caching. Data separation (option D) is specific to User Enrollment, a subset of MDM capabilities. TheMDM Protocol Referenceemphasizes remote management as MDM’s core benefit.

Activation Lock prevents reuse. ThemacOS Security Overviewstates, "Activation Lock, manageable via MDM, prevents a lost or stolen Mac from being reactivated without the owner’s credentials." Option C is iOS-specific.

Apple’s MDM framework standardizes tools. TheMobile Device Management Protocol Referencestates, "Apple’s MDM framework provides a consistent set of APIs and management tools that all MDM vendors use to manage Apple devices." Option D supports communication, not tools.

Administrator and People Manager roles manage federation but use local ABM/ASM credentials. TheApple Business Manager User Guidestates, "Administrators and People Managers can configure and manage the federation process in Apple Business Manager or Apple School Manager, but their accounts remain local and cannot sign in using federated authentication." Options C, D, and E lack these permissions or are not relevant roles for federation management.

Automated Device Enrollment (ADE) is ideal for distributing devices to multiple users across multiple regions because it allows enrollment in an MDM solution without physically handling the devices. Devices are pre-registered in Apple Business Manager or Apple School Manager, and upon setup, they automatically enroll in MDM, streamlining deployment at scale. Device Enrollment (option A) requires manual profile installation, impractical for large, dispersed deployments. User Enrollment (option B) is suited for BYOD, not organization-owned devices distributed widely. TheApple Platform Deployment Guiderecommends ADE for such scenarios.

System+User Mode supports pre- and post-login connectivity. TheApple Platform Deployment Guidestates, "System+User Mode for 802.1X allows a Mac to connect to Wi-Fi using system credentials before login and switches to user credentials after login, ensuring network access at all stages." Option B is not a standard term, C requires login first, and D uses only system credentials.

Bonjour enables service discovery on a LAN. ThemacOS Deployment Referencestates, "Bonjour supports discovering services such as printers, file shares, and other resources on a local network." Options A, B, and D are unrelated to Bonjour’s function.

TheLock a Maccommand generates a six-digit PIN for unlocking. TheMobile Device Management Protocol Referencestates, "The Lock command sent via MDM locks a Mac and generates a six-digit PIN that must be entered to regain access." Option A prevents booting, B wipes the device, and D is iOS-specific.