ACS Security Practices & Data Protection 3 — Questions and Answers
Question 1: A technician needs to recover a FileVault-encrypted Mac whose user has forgotten their login password. What is the correct recovery method?
- Boot to Recovery and use Disk Utility to reformat
- Use the FileVault Recovery Key or the linked Apple ID to unlock and reset the password (Correct answer)
- Remove the drive and decrypt on another Mac
- Disable SIP and reset from Terminal
Correct answer: Use the FileVault Recovery Key or the linked Apple ID to unlock and reset the password
FileVault-encrypted Macs can be recovered using the personal Recovery Key generated at setup, or via the owner's Apple ID if that option was chosen.
Question 2: What does 'app sandboxing' protect against on macOS?
- Unauthorized network connections to Apple servers
- An app accessing resources and data outside its designated container (Correct answer)
- Malware in the kernel extension layer
- Unauthorized Bluetooth pairing
Correct answer: An app accessing resources and data outside its designated container
Sandboxing restricts each app to its own container, preventing it from accessing other apps' data or sensitive system resources without explicit permission.
Question 3: A company policy requires that a Mac not be usable if it is reported stolen, even after a wipe. Which combination of features enforces this?
- FileVault + SIP
- Activation Lock + Apple Business Manager (ABM) Device Enrollment (Correct answer)
- Gatekeeper + XProtect
- iCloud Backup + Remote Wipe
Correct answer: Activation Lock + Apple Business Manager (ABM) Device Enrollment
Activation Lock combined with ABM ensures a wiped device remains locked to the organization's Apple ID until released by an administrator.
Question 4: Which network security protocol does Apple recommend for enterprise Wi-Fi to provide the strongest user authentication for Mac clients?
- WEP with 128-bit keys
- WPA2/WPA3 Enterprise with 802.1X and certificate-based EAP (Correct answer)
- WPA2-Personal with a strong passphrase
- Open network with a captive portal login
Correct answer: WPA2/WPA3 Enterprise with 802.1X and certificate-based EAP
802.1X with certificate-based EAP (such as EAP-TLS) provides individual user authentication without sharing a common passphrase.
Question 5: What is XProtect's role in macOS security?
- It enforces app notarization checks at install time
- It provides signature-based malware detection built into the OS (Correct answer)
- It monitors kernel extensions for unauthorized code
- It scans email attachments in Mail.app
Correct answer: It provides signature-based malware detection built into the OS
XProtect is Apple's built-in signature-based anti-malware that automatically checks downloaded files against a database of known malware.
Question 6: A user wants to share their screen with a remote IT technician. Which built-in macOS control requires the user to actively accept each incoming screen-sharing request?
- Screen Time request approval
- Consent prompt in Screen Sharing / Remote Management preferences (Correct answer)
- Gatekeeper approval dialog
- App Store permission review
Correct answer: Consent prompt in Screen Sharing / Remote Management preferences
macOS Screen Sharing can be configured to require the user to confirm each incoming connection before access is granted.
Question 7: Which Apple security feature ensures that only Apple-signed software runs at the lowest levels of macOS boot, preventing bootkits?
- Gatekeeper
- Secure Boot (with Full Security setting) (Correct answer)
- System Integrity Protection (SIP)
- Kernel Extension consent
Correct answer: Secure Boot (with Full Security setting)
Secure Boot at Full Security level ensures only Apple-signed bootloaders and OS software can start, blocking bootkits and unsigned boot code.
ACS Security Practices & Data Protection 3
A technician needs to recover a FileVault-encrypted Mac whose user has forgotten their login password.
What is the correct recovery method?