Systems Manager and Endpoint Management Flashcards

What is Meraki Systems Manager Sentry, and what is its primary purpose?

Answer: A feature that integrates SM with Meraki MR and MX to enforce network access control based on device compliance status

SM Sentry integrates Systems Manager with Meraki MR access points and MX appliances to enforce network access control (NAC), allowing only compliant and enrolled devices to connect to protected SSIDs or VPN tunnels.

How does Systems Manager Sentry WiFi integration work with Meraki MR access points?

Answer: SM pushes Wi-Fi credentials to enrolled devices; if a device is non-compliant, it is automatically moved to a restricted SSID via the MR

Sentry WiFi pushes SSID profiles and credentials to SM-enrolled devices; additionally, if a device loses compliance, SM can instruct the MR to move the device to a restricted SSID, effectively enforcing NAC.

An administrator wants to ensure that only SM-enrolled and compliant devices can connect to a corporate SSID on a Meraki MR. Which feature should be configured?

Answer: Systems Manager Sentry with the SSID set to 'SM Sentry' association requirement

Configuring the MR SSID association type as 'SM Sentry' enforces that only devices with a valid SM enrollment and passing compliance checks can associate to that SSID.

What type of VPN configuration in Systems Manager allows only traffic from specific applications to traverse the VPN tunnel on an iOS device?

Answer: Per-app VPN

Per-app VPN, configured via a Systems Manager profile payload, routes VPN traffic only for designated apps, preventing all other traffic from entering the tunnel and improving performance for BYOD scenarios.

How does Systems Manager distribute managed apps to enrolled iOS devices?

Answer: By pushing App Store apps using Apple Volume Purchase Program (VPP) / Apple Business Manager licenses managed in SM

Systems Manager integrates with Apple Volume Purchase Program (now part of Apple Business Manager) to silently push licensed App Store apps to enrolled iOS devices without requiring end-user Apple IDs.

Which Systems Manager profile payload type is used to push corporate email account settings automatically to enrolled mobile devices?

Answer: Exchange ActiveSync (EAS) or email payload

The Exchange ActiveSync or email payload in a Systems Manager profile automatically configures corporate email accounts on enrolled devices, eliminating the need for users to manually enter server details.

What happens to a device's network access when it violates a Systems Manager compliance policy and SM Sentry is configured on the associated MR SSID?

Answer: The device is disassociated from the corporate SSID or moved to a restricted SSID until compliance is restored

With SM Sentry enforcement, a non-compliant device is automatically disassociated from the corporate SSID or quarantined to a restricted SSID, preventing access to corporate resources until the compliance issue is resolved.