ACSP Startup and System Issues 2 — Questions and Answers
Question 1: What does a solid tone (no startup chime) or continuous blinking power LED indicate on an Intel Mac?
- A solid tone with no chime typically indicates a hardware issue — RAM failure is a common cause; a continuous blinking power LED indicates the Mac couldn't complete startup (Correct answer)
- A solid tone is normal on newer Macs; the startup chime was removed in macOS Catalina
- A continuous blinking power LED means FileVault is encrypting the drive in the background
- A solid tone indicates the Mac is in Target Disk Mode and ready for a cable connection
Correct answer: A solid tone with no chime typically indicates a hardware issue — RAM failure is a common cause; a continuous blinking power LED indicates the Mac couldn't complete startup
On Intel Macs, POST (Power-On Self-Test) failure indicators include tones (1 tone = RAM not recognized or failed; 3 tones = RAM failed Basic Memory Module check) and LED blink codes on Mac Pro/Mac mini, indicating hardware issues before macOS loads.
Intel Mac POST signals: 1 tone at startup = no RAM detected or not recognized; 3 successive tones, pause, 3 tones, 3 tones = RAM failed Basic Memory Module check; continuous tones = problem with EFI firmware update. Mac mini blink codes (power LED): 1 blink = no RAM installed; 2 blinks = incompatible RAM; 3 blinks = RAM banks failed integrity check; 4 blinks = bad checksum. Mac Pro has a system status LED visible from the front. None of these startup diagnostics apply to Apple silicon Macs, which have different diagnostic approaches. For Apple silicon Mac startup issues, DFU mode and Apple Configurator 2 are the primary recovery tools.
Question 2: What is kernel panic on macOS and what information should a technician collect when diagnosing it?
- Kernel panic is a fatal system error where the macOS kernel cannot recover; technicians should collect panic logs from /Library/Logs/DiagnosticReports/ and the crash reporter info shown at restart (Correct answer)
- Kernel panic only occurs on Apple silicon Macs and is resolved by resetting the SMC
- Kernel panic is the same as a spinning beachball (wait cursor) and indicates an app has hung
- Kernel panic logs are stored in the Time Machine backup only and cannot be accessed from the live system
Correct answer: Kernel panic is a fatal system error where the macOS kernel cannot recover; technicians should collect panic logs from /Library/Logs/DiagnosticReports/ and the crash reporter info shown at restart
Kernel panic is an unrecoverable kernel crash causing immediate system restart. Panic logs are saved to /Library/Logs/DiagnosticReports/ with .panic extension and contain stack traces, loaded KEXTs, and memory state at time of crash — critical for diagnosing the cause.
Kernel panic diagnostic approach: 1) Check /Library/Logs/DiagnosticReports/ for .panic files (most recent is most relevant). 2) Look for the 'Backtrace' section — it shows what code was running. 3) Check 'Kernel Extensions in backrace' — third-party KEXTs are frequent culprits. 4) Note 'BSD process name' — the app involved. 5) Check 'panic string' for the error message. Common causes: faulty third-party KEXTs, bad RAM (run Apple Diagnostics), graphics driver issues, corrupt system files. The Console app (macOS Monterey+) or 'log show --predicate' can help correlate system events before the panic. Recent panics also show when you click 'Restart' after a panic — macOS may show 'Your Mac restarted because of a problem.'
Question 3: What does it mean when a Mac displays a folder with a flashing question mark at startup?
- The Mac cannot find a bootable operating system — the startup disk is not set, is missing, or its macOS installation is damaged (Correct answer)
- The Mac needs a firmware update that can only be installed from Recovery
- The question mark indicates the Mac needs to be activated before first use
- The flashing folder means the Mac is in Target Disk Mode and searching for a host Mac
Correct answer: The Mac cannot find a bootable operating system — the startup disk is not set, is missing, or its macOS installation is damaged
A flashing folder with a question mark means the Mac's firmware cannot find a valid, bootable macOS installation. This can occur when: the startup disk is not set in System Settings, the macOS installation is corrupt, the internal drive has failed, or a new SSD was installed without macOS.
Troubleshooting flashing question mark: 1) Boot to Recovery (hold Power on Apple silicon or Cmd+R on Intel). 2) Open Startup Disk and select the macOS volume — if it appears, the system just lost its boot setting. 3) If no volume appears, boot to Recovery and run Disk Utility First Aid — check if the drive is detected. 4) If the drive is not detected, there may be a hardware failure (drive, cable, or logic board). 5) Try Safe Mode (hold Shift) to bypass potential boot file corruption. 6) If detected but no macOS, use 'Reinstall macOS' in Recovery. On Apple silicon Macs, this symbol may be replaced by a different startup indicator, but the diagnostic approach is similar.
Question 4: What is the Apple Diagnostics tool and how do you access it on Apple silicon Macs?
- Apple Diagnostics tests hardware components (logic board, memory, storage, wireless); on Apple silicon hold the Power button at startup, select Options, then Command + D after selecting the volume (Correct answer)
- Apple Diagnostics is a third-party tool that must be downloaded from Apple's support website before running
- Apple Diagnostics is accessed by holding D during startup on both Intel and Apple silicon Macs identically
- Apple Diagnostics is only available during an Apple Authorized Service Provider appointment and cannot be run by end users
Correct answer: Apple Diagnostics tests hardware components (logic board, memory, storage, wireless); on Apple silicon hold the Power button at startup, select Options, then Command + D after selecting the volume
Apple Diagnostics (formerly Apple Hardware Test) tests Mac hardware. On Apple silicon Macs: press and hold Power button → startup options appear → hold Command+D to launch Apple Diagnostics. On Intel Macs: hold D at startup (or Option+D for internet-based diagnostics).
Apple Diagnostics runs a suite of hardware tests: logic board, memory, storage, thermal sensors, power system, and wireless components. After testing, it provides reference codes: PPT001-PPT004 (power adapter issues), NDR001 (Wi-Fi problems), MEM001-MEM009 (memory issues), HDD various codes (storage issues), VFD various codes (video/display). Reference codes can be used to look up issues on Apple's support site or provide to Apple Support/AASP. Apple Diagnostics takes 2-5 minutes for a standard test. If issues are found, it may suggest contacting Apple Support or visiting an Apple Store. On Apple silicon, if Diagnostics isn't accessible via the startup options method, try Option+D to download and run internet-based diagnostics.
Question 5: What does macOS's System Integrity Protection (SIP) protect and how does it affect technician workflows?
- SIP protects critical system directories (/System, /usr, /bin, /sbin) and processes from modification even by root; disabling it for certain tasks requires booting to Recovery and using 'csrutil disable' (Correct answer)
- SIP requires admin authentication for any change to system files but allows root access without restriction
- SIP is a network security feature that prevents unauthorized connections to protected system services
- SIP only protects against external attacks and does not restrict local admin user operations
Correct answer: SIP protects critical system directories (/System, /usr, /bin, /sbin) and processes from modification even by root; disabling it for certain tasks requires booting to Recovery and using 'csrutil disable'
SIP (System Integrity Protection) protects system directories and processes from modification, even by root. Legitimate system management tasks that require SIP to be disabled (like installing certain legacy software) require booting to Recovery and running 'csrutil disable' — though this is strongly discouraged.
SIP-protected paths: /System, /usr (except /usr/local), /bin, /sbin, /Applications (for Apple-installed apps). SIP also prevents: loading unsigned kernel extensions, attaching to system processes with DYLD_INSERT_LIBRARIES, modifying DTrace probes, and accessing certain kernel features. Check SIP status with 'csrutil status'. SIP can be partially disabled: 'csrutil enable --without kext' disables only KEXT restriction while keeping file system protection. For Apple silicon Macs, 'csrutil disable' requires Reduced or Permissive Security to be set in Startup Security Utility. Apple silicon Macs also have Signed System Volume (SSV) as an additional layer even beyond SIP.
Question 6: How do you use the macOS Recovery Terminal to reset a forgotten admin password?
- Boot to Recovery, open Terminal, run 'resetpassword', which launches a GUI tool to reset any user's password or set a new admin account (Correct answer)
- Boot to Recovery, open Terminal, run 'passwd [username]' to reset the password without any additional tools
- Password reset in Recovery requires an Apple ID linked to the account — command line methods are disabled for security
- Boot to single-user mode, mount the root volume read/write, and use 'dscl . passwd /Users/[name]'
Correct answer: Boot to Recovery, open Terminal, run 'resetpassword', which launches a GUI tool to reset any user's password or set a new admin account
In macOS Recovery Terminal, running 'resetpassword' (one word, no spaces, as root) launches a graphical Reset Password tool that allows changing any local user's password, or creating a new admin account if all admin passwords are lost.
Steps: 1) Boot to Recovery (hold Power on Apple silicon or Cmd+R on Intel). 2) From the menu bar, choose Utilities > Terminal. 3) Type 'resetpassword' and press Return. 4) The Reset Password GUI appears with options to: reset a local user's password (select volume, select user, enter new password), or create a new admin account. Note: On FileVault-encrypted Macs, you may need to unlock the disk first with the FileVault recovery key. On Apple silicon with ADE/MDM supervision, the Mac's security policy may prevent password resets without MDM authorization. For Macs with iCloud-linked accounts, the Apple ID password reset option may also appear during Recovery tools.
ACSP Startup and System Issues 2
What does a solid tone (no startup chime) or continuous blinking power LED indicate on an Intel Mac?