Security and Compliance Flashcards

What is the purpose of the Restricted Software feature in Jamf Pro?

Answer: Automatically removing or blocking specified applications from running on managed devices

Restricted Software in Jamf Pro monitors for specified applications and can automatically kill the process, delete the app, or notify IT when a prohibited app is detected.

How does Jamf Pro ensure only compliant devices can access corporate resources?

Answer: By using Smart Group-based policy scoping so only compliant devices receive access-enabling configurations like VPN certificates

Admins create Smart Groups based on compliance criteria and scope network access configurations (certificates, VPN profiles) only to compliant devices, effectively gating resource access.

What is the purpose of the SCEP payload in a Jamf Pro Configuration Profile?

Answer: Automatically requesting and installing identity certificates from a CA via the SCEP protocol for device authentication

The SCEP payload automates certificate enrollment from a Certificate Authority, issuing unique device identity certificates that can be used for 802.1X Wi-Fi or VPN authentication.

What does the 'Enable/Disable Remote Management' MDM command control on managed Macs?

Answer: Turning Apple Remote Desktop management permissions on or off for the device

This MDM command controls whether Apple Remote Desktop is enabled on a managed Mac, allowing IT to remotely observe or control the Mac's screen.

How does Jamf Pro handle the re-enrollment of a device that was previously wiped?

Answer: The device re-enrolls automatically via ADE/PreStage Enrollment when powered on if it is an ABM-managed device

ABM-linked devices automatically return to Jamf Pro via ADE after a wipe — the device's serial number is still registered in ABM and the PreStage enrollment applies again.

What is the purpose of the Jamf Pro compliance baseline feature using Extension Attributes and Smart Groups?

Answer: Building a continuous compliance framework that auto-identifies and remediates devices drifting from the security baseline

Extension Attributes gather compliance data (e.g., firewall status, SIP status), Smart Groups identify non-compliant devices, and policies remediate them — creating a self-healing compliance loop.