ACSP macOS Platform Security (Gatekeeper, SIP, Notarization, XProtect) — Questions and Answers
Question 1: What is the primary purpose of Gatekeeper in macOS?
- To encrypt files before they are written to the startup disk
- To block unauthorized network connections from untrusted IP addresses
- To verify that apps come from identified developers and have not been tampered with before allowing them to run (Correct answer)
- To prevent users without administrator privileges from installing any software
Correct answer: To verify that apps come from identified developers and have not been tampered with before allowing them to run
Gatekeeper checks apps against Apple's requirements for identified Developer ID signatures and notarization. It prevents apps from unknown or unverified sources from launching without explicit user override, acting as the first line of defense against malicious software at the point of execution.
Question 2: What does Apple's notarization service verify when a developer submits an app?
- That the app meets App Store visual design and Human Interface Guidelines
- That the app has been manually reviewed by an Apple engineer for privacy compliance
- That the app is signed with a valid Developer ID and has been scanned for known malware (Correct answer)
- That the app's binary size is under the limit for distribution outside the App Store
Correct answer: That the app is signed with a valid Developer ID and has been scanned for known malware
Apple's notarization process is automated: it scans the submitted app for known malware and verifies it carries a valid Developer ID signature. It does not involve human code review. Once approved, a notarization ticket is stapled to the app so Gatekeeper can verify it offline.
Question 3: A technician must disable System Integrity Protection (SIP) on an Intel-based Mac to install a low-level kernel extension. What is the correct procedure?
- Run 'sudo csrutil disable' in the standard macOS Terminal
- Boot into Safe Mode, then run 'csrutil disable' in Terminal
- Boot into macOS Recovery (Command-R at startup), then run 'csrutil disable' in Terminal (Correct answer)
- Use Apple Configurator 2 to push a supervised profile that disables SIP remotely
Correct answer: Boot into macOS Recovery (Command-R at startup), then run 'csrutil disable' in Terminal
SIP can only be modified from the macOS Recovery environment (reached by holding Command-R during startup on Intel Macs, or holding the power button on Apple silicon). Running 'csrutil disable' from a normal booted session — even as root — has no effect because SIP is enforced before the OS fully loads.
Question 4: Which of the following actions does System Integrity Protection (SIP) prevent, even when executed with root or sudo privileges?
- Installing third-party apps into /Applications
- Creating new administrator user accounts via Terminal
- Modifying files located in /System, /usr, /bin, and /sbin (Correct answer)
- Mounting external drives formatted with ExFAT
Correct answer: Modifying files located in /System, /usr, /bin, and /sbin
SIP marks critical system directories — /System, /usr, /bin, /sbin, and pre-installed Apple apps — as read-only for all processes, including root. This prevents malware or poorly-written software from corrupting core OS components. User-installed apps in /Applications and user data are not restricted by SIP.
Question 5: A user on a Mac attempts to open a downloaded app that has not been notarized. What is the default Gatekeeper behavior on modern macOS?
- The app opens with a one-time warning notification in Notification Center
- macOS quarantines the app and runs it in an isolated sandbox automatically
- macOS refuses to open the app and displays an alert stating it cannot be checked for malicious software (Correct answer)
- macOS submits the app to Apple for expedited notarization before allowing it to run
Correct answer: macOS refuses to open the app and displays an alert stating it cannot be checked for malicious software
By default, Gatekeeper blocks unnotarized apps and shows a dialog saying the app 'cannot be checked for malicious software.' The user can override this only by going to System Settings > Privacy & Security and explicitly clicking 'Open Anyway' — a deliberate, non-default action required each time.
Question 6: What is the primary function of XProtect in macOS?
- Monitoring network traffic for intrusion attempts and blocking suspicious connections
- Scanning downloaded files and launched apps against a database of known malware signatures (Correct answer)
- Preventing apps from accessing the camera and microphone without user permission
- Validating the cryptographic signature of the macOS kernel at each startup
Correct answer: Scanning downloaded files and launched apps against a database of known malware signatures
XProtect is Apple's built-in, signature-based anti-malware engine. It automatically scans files when they are first downloaded or opened and compares them against an Apple-maintained database of known malware signatures. Apple silently updates XProtect signatures independently of macOS system updates.
ACSP macOS Platform Security (Gatekeeper, SIP, Notarization, XProtect)
What is the primary purpose of Gatekeeper in macOS?