CCT Troubleshooting & Maintenance 5 — Questions and Answers
Question 1: A Casper-managed device displays 'JSS not accessible' when running 'jamf checkJSSConnection'. The device is on the corporate network. What should be verified first?
- That the device's Jamf binary is up to date
- That the JSS URL, port, and SSL certificate are correct and reachable from the device (Correct answer)
- That Self Service is installed on the device
- That the device is registered in Active Directory
Correct answer: That the JSS URL, port, and SSL certificate are correct and reachable from the device
A failed JSS connection check almost always points to an incorrect URL, blocked port, or untrusted SSL certificate preventing the device from reaching the server.
Question 2: Which Jamf Pro feature allows a technician to run a command on a remote Mac without a full policy deployment?
- Casper Remote (now Jamf Remote) (Correct answer)
- Jamf Self Service
- Jamf Recon
- Jamf Composer
Correct answer: Casper Remote (now Jamf Remote)
Casper Remote (Jamf Remote) provides an interactive SSH-based interface for running commands, scripts, and management tasks on individual remote Macs.
Question 3: During maintenance, a technician finds that FileVault recovery keys are not being escrowed to Jamf Pro. What configuration is most likely missing?
- A FileVault 2 configuration profile with the 'Redirect FileVault keys to JSS' option enabled (Correct answer)
- A Jamf Pro admin account with disk encryption privileges
- The device must be in supervised mode for key escrow
- A scheduled recon must be set to run after FileVault enablement
Correct answer: A FileVault 2 configuration profile with the 'Redirect FileVault keys to JSS' option enabled
The FileVault 2 configuration profile must include the 'Redirect FileVault keys to JSS' payload option for recovery keys to be escrowed automatically.
Question 4: A technician is investigating why a Jamf Pro patch management policy is not applying updates to endpoints. The software title is correctly configured. What is the most common oversight?
- The patch policy grace period has not elapsed before the deadline
- The software title definition has not been updated to reflect the latest version (Correct answer)
- Patch management requires Jamf Connect to be installed
- The policy must be scoped to a static group
Correct answer: The software title definition has not been updated to reflect the latest version
Patch management in Jamf Pro requires the software title's definition to be updated with the latest version before policies can target devices needing that update.
Question 5: A macOS device managed by Casper repeatedly prompts the end user for keychain credentials after a password change. What Jamf Pro mechanism addresses this issue?
- Deploying a login window configuration profile
- Using Jamf Connect to synchronize the local macOS password with the identity provider (Correct answer)
- Running 'jamf policy -event passwordSync' on the device
- Re-issuing the device's MDM enrollment certificate
Correct answer: Using Jamf Connect to synchronize the local macOS password with the identity provider
Jamf Connect synchronizes the local macOS account password with the corporate identity provider, preventing keychain desynchronization after password changes.
Question 6: A Casper technician must ensure that all macOS devices have a specific kernel extension (kext) approved before a software deployment. Which Jamf Pro profile payload handles this?
- Privacy Preferences Policy Control (PPPC)
- Kernel Extension Policy payload
- System Extension Policy payload (for macOS 10.15+) (Correct answer)
- Content Filter payload
Correct answer: System Extension Policy payload (for macOS 10.15+)
On macOS Catalina (10.15) and later, Apple replaced kernel extensions with system extensions, managed via the System Extension Policy payload in a configuration profile.
Question 7: After deploying a new Jamf Pro configuration profile, several users report that their custom DNS settings were overwritten. What likely happened?
- The new profile included a Network payload that overwrote existing DNS configurations (Correct answer)
- Jamf Pro automatically resets DNS on every check-in
- The devices were re-enrolled during the profile push
- The profile deployment triggered a network interface reset
Correct answer: The new profile included a Network payload that overwrote existing DNS configurations
A configuration profile containing a Network payload can overwrite existing network settings including DNS, particularly when the payload is set to enforce specific values.
CCT Troubleshooting & Maintenance 5
A Casper-managed device displays 'JSS not accessible' when running 'jamf checkJSSConnection'.
The device is on the corporate network.
What should be verified first?