Apple DEP-2025 Practice Exams
Last updated on Oct 21,2026- Exam Code: DEP-2025
- Exam Name: Apple Deployment and Management Exam
- Certification Provider: Apple
- Latest update: Oct 21,2026
Question #11
A user reports that their managed Mac is asking for a six-digit PIN after an unexpected restart.
What explains this?
- A . You turned on Activation Lock.
- B . You sent the EraseDevice command.
- C . You sent the Lock a Mac command.
- D . You turned on Managed Lost Mode.
Correct Answer: C
C
Explanation:
The Lock a Mac command generates a six-digit PIN for unlocking. The Mobile Device Management Protocol Reference states, "The Lock command sent via MDM locks a Mac and generates a six-digit PIN that must be entered to regain access." Option A prevents booting, B wipes the device, and D is iOS-specific.
Reference: Mobile Device Management Protocol Reference, "Lock Command" section.
macOS Security Overview, "Device Locking" section.
C
Explanation:
The Lock a Mac command generates a six-digit PIN for unlocking. The Mobile Device Management Protocol Reference states, "The Lock command sent via MDM locks a Mac and generates a six-digit PIN that must be entered to regain access." Option A prevents booting, B wipes the device, and D is iOS-specific.
Reference: Mobile Device Management Protocol Reference, "Lock Command" section.
macOS Security Overview, "Device Locking" section.
Question #12
You bought new app licenses in Apple Business Manager, but they’re not available in your MDM solution.
What might cause this?
- A . A password change to the MDM administrator account
- B . APNs token annual expiration
- C . Content token annual expiration
- D . Creation of a new Content Manager
Correct Answer: C
C
Explanation:
Content token expiration disrupts app sync. The Apple Business Manager User Guide states, "If the content token expires, app licenses won’t sync to the MDM solution until it’s renewed."
Option B affects notifications, not apps.
Reference: Apple Business Manager User Guide, "Apps and Books" section.
Mobile Device Management Protocol Reference, "Content Token" section.
C
Explanation:
Content token expiration disrupts app sync. The Apple Business Manager User Guide states, "If the content token expires, app licenses won’t sync to the MDM solution until it’s renewed."
Option B affects notifications, not apps.
Reference: Apple Business Manager User Guide, "Apps and Books" section.
Mobile Device Management Protocol Reference, "Content Token" section.
Question #13
Which feature allows IT administrators to remotely wipe a device?
- A . Activation Lock
- B . Find My
- C . MDM
- D . iCloud
Correct Answer: C
C
Explanation:
Mobile Device Management (MDM) provides IT administrators with the capability to remotely wipe a device, either fully (factory reset) or selectively (removing managed data), via commands sent over APNs. This is a core MDM feature for security and compliance. Activation Lock (option A) prevents unauthorized reactivation after a wipe but doesn’t perform the wipe. Find My (option B) allows users to wipe their own devices, not administrators. iCloud (option D) supports personal wipes via Find My, not organizational ones. The MDM Protocol Reference confirms MDM’s remote wipe functionality.
Reference: MDM Protocol Reference (Section: Remote Wipe Commands).
C
Explanation:
Mobile Device Management (MDM) provides IT administrators with the capability to remotely wipe a device, either fully (factory reset) or selectively (removing managed data), via commands sent over APNs. This is a core MDM feature for security and compliance. Activation Lock (option A) prevents unauthorized reactivation after a wipe but doesn’t perform the wipe. Find My (option B) allows users to wipe their own devices, not administrators. iCloud (option D) supports personal wipes via Find My, not organizational ones. The MDM Protocol Reference confirms MDM’s remote wipe functionality.
Reference: MDM Protocol Reference (Section: Remote Wipe Commands).
Question #14
Which type of device supports macOS Server features?
- A . iPad with iPadOS 13 or later
- B . iPhone with iOS 13 or later
- C . Mac with macOS 10.14 or later
- D . Apple Watch with watchOS 6 or later
Correct Answer: C
C
Explanation:
macOS Server features (e.g., Profile Manager, file sharing) are supported on Mac computers running macOS. While macOS Server as a standalone app was discontinued after macOS 10.13, its features were integrated into macOS itself starting with 10.14 (Mojave) and later. iPads (option A), iPhones (option B), and Apple Watches (option D) don’t support macOS Server functionality, as they run different operating systems. The Apple Platform Deployment Guide specifies macOS requirements for these features.
Reference: Apple Platform Deployment Guide (Chapter: macOS Server).
C
Explanation:
macOS Server features (e.g., Profile Manager, file sharing) are supported on Mac computers running macOS. While macOS Server as a standalone app was discontinued after macOS 10.13, its features were integrated into macOS itself starting with 10.14 (Mojave) and later. iPads (option A), iPhones (option B), and Apple Watches (option D) don’t support macOS Server functionality, as they run different operating systems. The Apple Platform Deployment Guide specifies macOS requirements for these features.
Reference: Apple Platform Deployment Guide (Chapter: macOS Server).
Question #15
You used your organization’s MDM solution to change the password of a managed administrator account that’s secure token enabled.
What is the result?
- A . The secure token password is updated, not the login password.
- B . The login password is updated, not the secure token password.
- C . The login and secure token passwords are updated.
- D . The login password can’t be changed.
Correct Answer: B
B
Explanation:
MDM updates the login password only. The macOS Security Overview states, "When MDM changes the password of a secure token-enabled account, only the login password is updated; the secure token remains tied to the original password unless explicitly reset." Option C is incorrect due to this separation.
Reference: macOS Security Overview, "Secure Token" section.
Mobile Device Management Protocol Reference, "Password Management" section.
B
Explanation:
MDM updates the login password only. The macOS Security Overview states, "When MDM changes the password of a secure token-enabled account, only the login password is updated; the secure token remains tied to the original password unless explicitly reset." Option C is incorrect due to this separation.
Reference: macOS Security Overview, "Secure Token" section.
Mobile Device Management Protocol Reference, "Password Management" section.
Question #16
You’re using Apple Business Manager or Apple School Manager.
Which two account roles can manage the federation process, but can’t sign in using federated authentication? (Select two.)
- A . Administrator
- B . People Manager
- C . Content Manager
- D . Device Enrollment Manager
- E . Manager
Correct Answer: AB
AB
Explanation:
Administrator and People Manager roles manage federation but use local ABM/ASM credentials. The Apple Business Manager User Guide states, "Administrators and People Managers can configure and manage the federation process in Apple Business Manager or Apple School Manager, but their accounts remain local and cannot sign in using federated authentication."
Options C, D, and E lack these permissions or are not relevant roles for federation management.
Reference: Apple Business Manager User Guide, "Roles and Federated Authentication" section.
Apple Platform Deployment Guide, "Identity Management Roles" section.
AB
Explanation:
Administrator and People Manager roles manage federation but use local ABM/ASM credentials. The Apple Business Manager User Guide states, "Administrators and People Managers can configure and manage the federation process in Apple Business Manager or Apple School Manager, but their accounts remain local and cannot sign in using federated authentication."
Options C, D, and E lack these permissions or are not relevant roles for federation management.
Reference: Apple Business Manager User Guide, "Roles and Federated Authentication" section.
Apple Platform Deployment Guide, "Identity Management Roles" section.
Question #17
You manage the content caching server for your organization. You want the content caching server to cache only software and app updates.
Which option should you choose from the Cache menu?
- A . Only Shared Content
- B . All Content
- C . Only iCloud Content
- D . All Updates
Correct Answer: A
A
Explanation:
“Only Shared Content” caches updates. The macOS Deployment Reference states, "Selecting ‘Only Shared Content’ in the Cache menu ensures the content caching server caches software and app updates, excluding iCloud data." Option D isn’t a real setting.
Reference: macOS Deployment Reference, "Content Caching" section.
Apple Platform Deployment Guide, "Caching Settings" section.
A
Explanation:
“Only Shared Content” caches updates. The macOS Deployment Reference states, "Selecting ‘Only Shared Content’ in the Cache menu ensures the content caching server caches software and app updates, excluding iCloud data." Option D isn’t a real setting.
Reference: macOS Deployment Reference, "Content Caching" section.
Apple Platform Deployment Guide, "Caching Settings" section.
Question #18
Which Apple technology can an identity provider (IdP) use to implement modern authentication protocols for iPhone, iPad, and Mac?
- A . Single sign-on (SSO) extensions
- B . Network Relay
- C . IPSec
- D . WireGuard
Correct Answer: A
A
Explanation:
SSO extensions support modern protocols. The Apple Platform Deployment Guide states, "Single sign-on (SSO) extensions allow IdPs to integrate modern authentication protocols like OAuth 2.0 or OpenID Connect across iOS, iPadOS, and macOS." Options B, C, and D (corrected from "WireGuar") are networking technologies, not authentication-focused.
Reference: Apple Platform Deployment Guide, "SSO Extensions" section.
macOS Security Overview, "Authentication Technologies" section.
A
Explanation:
SSO extensions support modern protocols. The Apple Platform Deployment Guide states, "Single sign-on (SSO) extensions allow IdPs to integrate modern authentication protocols like OAuth 2.0 or OpenID Connect across iOS, iPadOS, and macOS." Options B, C, and D (corrected from "WireGuar") are networking technologies, not authentication-focused.
Reference: Apple Platform Deployment Guide, "SSO Extensions" section.
macOS Security Overview, "Authentication Technologies" section.
Question #19
Which MDM option gives you the ability to keep the same eSIM service for an iPhone that you redeploy?
- A . Redeploy with eSIM
- B . Remote wipe
- C . Rapid deployment
- D . Managed erase
Correct Answer: B
B
Explanation:
Remote wipe preserves eSIM. The Mobile Device Management Protocol Reference states, "The EraseDevice command with the preserveDataPlan option allows MDM to keep the eSIM active during a wipe, aiding redeployment."
Reference: Mobile Device Management Protocol Reference, "EraseDevice Command" section.
iOS Deployment Reference, "eSIM Management" section.
B
Explanation:
Remote wipe preserves eSIM. The Mobile Device Management Protocol Reference states, "The EraseDevice command with the preserveDataPlan option allows MDM to keep the eSIM active during a wipe, aiding redeployment."
Reference: Mobile Device Management Protocol Reference, "EraseDevice Command" section.
iOS Deployment Reference, "eSIM Management" section.
Question #20
Which feature allows IT administrators to restrict apps on a device?
- A . Activation Lock
- B . Configuration profiles
- C . Find My
- D . iCloud
Correct Answer: B
B
Explanation:
Configuration profiles, deployed via MDM or manually, allow IT administrators to restrict apps on a device by setting policies such as blocking the App Store, preventing app removal, or allowing only specific apps (e.g., via an allow list). These profiles are highly customizable for security and compliance. Activation Lock (option A) secures device reactivation, not app restrictions. Find My (option C) and iCloud (option D) are user-focused features without app restriction capabilities. The Apple Platform Deployment Guide details configuration profiles’ role in app management.
Reference: Apple Platform Deployment Guide (Chapter: Configuration Profiles).
B
Explanation:
Configuration profiles, deployed via MDM or manually, allow IT administrators to restrict apps on a device by setting policies such as blocking the App Store, preventing app removal, or allowing only specific apps (e.g., via an allow list). These profiles are highly customizable for security and compliance. Activation Lock (option A) secures device reactivation, not app restrictions. Find My (option C) and iCloud (option D) are user-focused features without app restriction capabilities. The Apple Platform Deployment Guide details configuration profiles’ role in app management.
Reference: Apple Platform Deployment Guide (Chapter: Configuration Profiles).