Security Flashcards
(12 cards)
How can you tell if a restriction applies only to a supervised device?
Apple clearly labels any restriction that requires device supervision with the phrase “(supervised only)” in its official documentation and MDM tools. This tells admins that the restriction only applies to devices enrolled with supervision enabled (typically via Automated Device Enrollment or Apple Configurator).
How are security fixes distributed to Apple devices in a Rapid Security Response?
Rapid Security Response (RSR) updates are small, standalone updates Apple uses to deliver urgent security fixes without waiting for a full OS update. These are typically labeled like:
* iOS 16.4.1 (a)
* macOS 13.3.1 (a)
They are:
* Lightweight
* Quick to install
* Targeted at fixing specific critical security vulnerabilities
Rapid Security Responses are a new type of software release for iPhone, iPad, and Mac. They deliver important security improvements between software updates—for example, improvements to the Safari web browser, the WebKit framework stack, or other critical system libraries. They may also be used to mitigate some security issues more quickly, such as issues that might have been exploited or reported to exist “in the wild.”
An example of an MDM setting is the “CriticalUpdateInstall” key, which can be set to “true” to enable automatic RSR installation
Rapid Security Responses are a new type of software release for applying security fixes to users more frequently by not requiring a full software update. These responses are included in any ensuing minor update (not upgrade) and, on a Mac, applied content appears on the Preboot volume (through symbolic links in /System/Cryptexes/).
Rapid Security Responses that involve the operating system require the device to restart. For Mac computers, the applied operating system content may be made available to Safari and its associated processes with just a relaunch of those processes, though a restart is required to make this content broadly available to the rest of the operating system.
Rapid Security Responses also don’t adhere to the managed software update delay; however, because they apply only to the latest minor operating system version, if that minor operating system update is delayed, the response is also effectively delayed. If necessary, the user can also remove the responses.
When applying an RSR to a Mac laptop, the Mac needs to be connected to power or have the minimum battery percentages.
Which MDM restriction lets you manage a user’s ability to connect Thunderbolt or USB devices to a Mac?
Allow Thunderbolt or USB device connections
This MDM restriction controls whether users can connect Thunderbolt or USB peripherals to a Mac. It’s essential for securing Mac endpoints in high-security environments.
* When disabled, new external devices (like flash drives, external storage, or peripherals) are blocked.
* Often used to prevent data exfiltration or unauthorized hardware use.
This restriction is available only on supervised Macs running macOS 13 or later and must be delivered via MDM.
- USB Restricted Mode (iOS/iPadOS):
Purpose:
Restricts data connections with USB accessories when the device is locked, enhancing security.
Control:
Administrators can use MDM to disable USB Restricted Mode (allowing connections even when locked) or enable it (preventing connections when locked).
Impact:
When enabled, a user needs to unlock the device to connect to USB accessories. When disabled, connections can be made even when the device is locked. - Host Pairing Management (macOS):
Purpose:
Controls which computers can pair with a supervised Apple device over USB (or Thunderbolt on supported iPads).
Control:
MDM can be used to manage the “Allow pairing with non-Apple Configurator hosts” setting.
Impact:
Disabling this setting ensures that only trusted computers holding a valid supervision host certificate can pair with the device. - General Accessory Management (macOS):
macOS 13 and later:
New USB and Thunderbolt accessories require user approval when connecting to a locked Mac.
MDM Control:
MDM can configure settings like “Ask every time,” “Ask for new accessories,” “Automatically when unlocked,” or “Always” for connecting accessories.
Lockdown Mode:
If Lockdown Mode is enabled, the device ignores the MDM settings for accessory connections. - Considerations:
Supervision:
Supervised devices (often organization-owned) can be managed with more granular control over accessory connections.
Lockdown Mode:
Lockdown Mode provides a higher level of security and overrides MDM settings related to accessory connections.
User Experience:
Restricting accessory connections can impact user experience, especially when users need to connect to specific accessories frequently. Administrators should consider the balance between security and usability when configuring these restrictions.
How do you ensure that only trusted host computers can pair with your organization’s iPhone and iPad devices?
Supervision Identities
To ensure that only trusted host computers can pair with your organization’s iPhones and iPads, you must use supervision identities.
What are Supervision Identities?
* A supervision identity is a cryptographic identity (certificate + key) created when a device is supervised using Apple Configurator.
* When the same identity is installed on a Mac, only that Mac can pair with and access the device.
* This prevents unauthorized computers from accessing data via USB or Finder/iTunes.
Which payload do you use to configure specific rules when users create a password or passcode on their enrolled device?
Passcode
The Passcode payload is used in MDM to define specific rules for how users create and manage passcodes (on iOS/iPadOS) or passwords (on macOS). It enforces security policies such as:
* Minimum length
* Complexity (e.g., alphanumeric)
* Maximum passcode age
* Auto-lock duration
* Number of failed attempts before wipe
What is macOS Security & Privacy used for?
The macOS Security & Privacy payload in MDM is used to manage app and service-level permissions on macOS devices — specifically around features that require user consent, such as camera access, screen recording, file system access, and more.
It allows administrators to pre-configure or restrict how the system handles privacy-sensitive permissions by defining Transparency, Consent, and Control (TCC) settings.
What must a user do when you install the Passcode payload on the user’s iPhone?
The user must enter a passcode using the specified settings within 60 minutes.
When an MDM installs the Passcode payload on an iPhone (or iPad) that doesn’t already have a passcode set:
* The user is prompted to create a passcode that meets the organization’s security criteria.
* Apple gives the user 60 minutes to comply.
* If the user fails to set a passcode in that window, the device will be locked until a compliant passcode is created.
What’s required before you can restrict accessory connections on iPhone or iPad?
Device Supervision
To restrict accessory connections (such as USB or Lightning accessories) on an iPhone or iPad, the device must be supervised.
Supervision provides enhanced management capabilities, including:
* Restricting USB accessory access when locked
* Blocking accessory pairing
* Applying hardware-level restrictions unavailable to unsupervised devices
Supervision is typically enabled through:
* Automated Device Enrollment (ADE) via Apple Business Manager
* Apple Configurator (for manually supervised setup)
Why would you defer software updates on Apple devices?
To test critical apps and infrastructure before deploying the update. Deferring software updates gives IT teams time to test the latest iOS, iPadOS, or macOS versions with:
* In-house apps
* Mission-critical third-party software
* Network infrastructure (e.g., VPNs, MDM, Wi-Fi security)
This helps prevent compatibility issues and disruption to workflows during or after updates.
Apple allows you to defer updates for up to 90 days using MDM.
How can you distribute a certificate identity to a device in a configuration profile?
In a .p12 file
A .p12 file (also known as a PKCS#12 file) contains:
* A certificate
* Its corresponding private key
* Optionally, intermediate/root certificates in the chain
It is the standard format used in MDM configuration profiles to install identity certificates on Apple devices. These are used for:
* VPN authentication
* Wi-Fi 802.1X
* S/MIME email encryption
* Secure web access (client certificates)
The .p12 file must be password-protected and securely delivered via the Identity payload in a .mobileconfig profile.
What is a PKI token?
A PKI token is a hardware or smartcard-based authentication device, not a file or payload format. It’s used for secure storage of identities but not directly deployable in a configuration profile.
Which type of query can you use to find information about Find My and FileVault settings?
The Security query in MDM is used to retrieve information about critical device security settings, including:
* Find My iPhone / iPad / Mac status
* FileVault status (for macOS)
* Passcode presence and compliance
* Hardware encryption state
This query is part of Apple’s standard MDM protocol and is especially important for compliance audits, loss prevention, and device hardening verification.
