Security and Compliance Flashcards

How does Jamf Pro enforce OS update compliance on managed devices?

Answer: Using MDM software update commands and policies to push and enforce required OS versions

Jamf Pro can send MDM commands to defer or require specific OS versions and use policies or DDM (Declarative Device Management) to enforce update timelines.

What is Jamf Protect and how does it relate to Jamf Pro?

Answer: An endpoint security product for Mac that provides threat detection and integrates with Jamf Pro for compliance reporting

Jamf Protect is a separate Jamf product that provides macOS endpoint detection and response (EDR), with compliance data feeding back into Jamf Pro Smart Groups for policy enforcement.

What Jamf Pro feature allows you to report on devices that do not meet security requirements?

Answer: Smart Groups with compliance-based criteria that automatically identify non-compliant devices

Smart Groups scoped on criteria like FileVault status, OS version, or passcode compliance provide a live view of non-compliant devices that can trigger remediation policies.

What is the purpose of certificate-based authentication deployed via Jamf Pro?

Answer: Authenticating devices to secure network resources like Wi-Fi and VPN without requiring user passwords

Deploying identity certificates via Configuration Profile allows devices to authenticate to 802.1X Wi-Fi, VPN, or other resources using a machine certificate instead of a password.

What is Declarative Device Management (DDM) and how does Jamf Pro use it?

Answer: A newer Apple MDM framework where devices manage their own state based on declarations from the server

DDM is Apple's evolution of MDM where the server sends declarations (desired state) and devices autonomously ensure they match, reducing round trips and improving reliability.

What is the Clear Passcode command used for on supervised iOS devices in Jamf Pro?

Answer: Removing the current device passcode so the user can set a new one without needing the old code

The Clear Passcode MDM command removes the existing lock screen passcode on supervised iOS devices, allowing a locked-out user to set a new passcode.