ACSP User Accounts and Security 2 — Questions and Answers
Question 1: What is the difference between a Standard user account and an Administrator account in macOS?
- Standard users can only modify their own home folder and need admin authentication for system-wide changes; Administrators can install software, change System Settings, and manage other user accounts (Correct answer)
- Standard users and Administrators have identical permissions; the only difference is that Administrators can add new user accounts
- Standard users cannot access any applications in /Applications/; they can only run apps in ~/Applications/
- Administrator accounts bypass all macOS security features including Gatekeeper and SIP by default
Correct answer: Standard users can only modify their own home folder and need admin authentication for system-wide changes; Administrators can install software, change System Settings, and manage other user accounts
Standard users are limited to modifying their own home folder and settings, while Administrator accounts can install software system-wide, modify /Applications/, change System Settings affecting all users, and manage other user accounts — but are still subject to SIP and other security mechanisms.
macOS account privilege levels: Standard — read/write access to ~/; read access to /Applications/, /Library/; requires admin authentication (via dialog or sudo) for system changes. Administrator — same as Standard plus: can install apps to /Applications/, modify /Library/, change System Settings, create/delete user accounts, adjust security settings. Root — not a normal login account; accessed via sudo; has virtually unlimited system access but is blocked by SIP. All accounts are subject to SIP. Best practice: daily use Standard account, authenticate as Admin only when needed (principle of least privilege). macOS prompts for admin credentials even when logged in as admin for sensitive operations.
Question 2: How does FileVault 2 encryption work and what is the role of the FileVault Recovery Key?
- FileVault 2 uses XTS-AES-128 encryption to encrypt the entire APFS volume; the Recovery Key is a 24-character code that can decrypt the disk if the login password is forgotten (Correct answer)
- FileVault 2 encrypts only the user's home folder, leaving the system partition unencrypted for fast boot
- The FileVault Recovery Key is stored on Apple's servers and requires contacting Apple Support to retrieve it
- FileVault 2 uses the user's login password as the only encryption key; there is no separate recovery key
Correct answer: FileVault 2 uses XTS-AES-128 encryption to encrypt the entire APFS volume; the Recovery Key is a 24-character code that can decrypt the disk if the login password is forgotten
FileVault 2 uses XTS-AES-128 encryption to encrypt the full APFS container. The 24-character Recovery Key is generated at setup and can unlock the encrypted disk independently of the user's login password — critical if the password is forgotten and the Mac needs to be decrypted.
FileVault 2 encryption flow: A Volume Encryption Key (VEK) encrypts all data. The VEK is protected by user passwords and the Recovery Key. At boot, pre-boot authentication (EFI on Intel, iBoot on Apple silicon) prompts for an authorized user's password or Recovery Key to decrypt the VEK and proceed with startup. Recovery Key types: Personal (24-character alphanumeric, shown once during setup — store safely), Institutional (certificate-based, for MDM-managed Macs, stored in MDM). Losing both the password and Recovery Key = permanent data loss. MDM can escrow Recovery Keys (via Bootstrap Token on Apple silicon) so IT can retrieve them for managed Macs. 'fdesetup status' and 'fdesetup list' show FileVault status from Terminal.
Question 3: What is Keychain in macOS and what types of sensitive data does it store?
- Keychain is macOS's secure credential storage system that stores passwords, certificates, encryption keys, and secure notes, protected by the user's login password or a separate keychain password (Correct answer)
- Keychain is only used for storing website passwords in Safari and is separate from the general certificate store
- Keychain stores passwords but requires constant internet connectivity to sync with iCloud for verification
- Keychain is an admin-only tool that stores system certificates; regular users access passwords through the browser only
Correct answer: Keychain is macOS's secure credential storage system that stores passwords, certificates, encryption keys, and secure notes, protected by the user's login password or a separate keychain password
macOS Keychain stores passwords (website, Wi-Fi, email, app), digital certificates (CA, user, code signing), encryption keys, SSH keys, and secure notes in encrypted databases. The login keychain is automatically unlocked with the user's login password.
Keychain types: Login keychain (~/Library/Keychains/login.keychain-db) — unlocked at login, stores personal credentials. Local Items keychain (protected by Secure Enclave on T2/Apple silicon) — stores iCloud Keychain items for TouchID. System keychain (/Library/Keychains/System.keychain) — system-wide certificates and Wi-Fi passwords. System Roots keychain — Apple's trusted root CA certificates. Keychain Access app (/Applications/Utilities/Keychain Access.app) provides GUI management. Command line: 'security find-internet-password -s "apple.com"'. iCloud Keychain syncs across all devices signed with the same Apple ID. Keychain corruption can cause login issues — repair by deleting login.keychain-db (it regenerates) or using 'Keychain First Aid' in Keychain Access.
Question 4: What is Touch ID on Mac and what security technology protects the fingerprint data?
- Touch ID uses a capacitive fingerprint sensor; fingerprint data is processed and stored as a mathematical template in the Secure Enclave, never leaving the chip or being sent to Apple (Correct answer)
- Touch ID stores fingerprint images in an encrypted folder in the user's home directory
- Touch ID requires an internet connection to verify fingerprints against Apple's biometric database
- Touch ID fingerprint data is stored in the macOS Keychain and is backed up with Time Machine
Correct answer: Touch ID uses a capacitive fingerprint sensor; fingerprint data is processed and stored as a mathematical template in the Secure Enclave, never leaving the chip or being sent to Apple
Touch ID processes fingerprints in the Secure Enclave — a dedicated security processor isolated from the main CPU. Only a mathematical representation (not the raw fingerprint image) is stored, encrypted, in the Secure Enclave. This data never leaves the chip and is never shared with Apple or iCloud.
Touch ID security architecture: The fingerprint sensor captures the print and communicates encrypted data directly to the Secure Enclave. The Secure Enclave processes it, converts to a mathematical template, and stores it encrypted with keys that never leave the Secure Enclave. The Secure Enclave verifies matches and signals the processor 'authorized' or 'denied' without exposing the template. Touch ID data is tied to the specific Secure Enclave — replacing the logic board with a different Secure Enclave invalidates all enrolled fingerprints. Up to 5 fingerprints can be stored per Mac. Touch ID is used for Mac unlock, Apple Pay, App Store purchases, sudo in Terminal, and password autofill — all handled by the Secure Enclave.
Question 5: What are 'Managed Preferences' in macOS and how do they differ from regular preferences?
- Managed Preferences are enforced settings delivered via MDM or MCX that override user preferences and cannot be changed by users — shown with a lock icon in System Settings (Correct answer)
- Managed Preferences are preferences shared between multiple user accounts on the same Mac
- Managed Preferences are the default preferences set by Apple that apply before any user customization
- Managed Preferences are preferences synchronized via iCloud that apply across all a user's Macs
Correct answer: Managed Preferences are enforced settings delivered via MDM or MCX that override user preferences and cannot be changed by users — shown with a lock icon in System Settings
Managed Preferences (set via MDM configuration profiles or legacy MCX from directory services) enforce system and application settings that users cannot change. They appear with a lock icon in System Settings, indicating the setting is under organizational control.
Managed Preferences are stored in /Library/Managed Preferences/ (system-wide) and ~/Library/Managed Preferences/ (user-level). The preference file names follow the same reverse-DNS convention as regular preferences (e.g., com.apple.dock.plist). When a managed preference exists for a domain, macOS merges it with the user's preference, with managed values taking precedence. MDM delivers managed preferences through configuration profiles. Common managed settings: enforce screensaver lock timeout, disable guest user, set minimum password length, restrict which System Settings panes are accessible, configure approved kernel extensions. 'sudo profiles -P' lists installed profiles, 'defaults read /Library/Managed\ Preferences/com.apple.dock' shows managed Dock settings.
Question 6: What is the purpose of the macOS 'Secure Token' and when is it required?
- A Secure Token is a cryptographic token granted to user accounts that enables them to unlock FileVault-encrypted volumes — required for FileVault enablement and MDM bootstrap token generation on Apple silicon (Correct answer)
- A Secure Token is an Apple ID authentication token required for App Store purchases on managed Macs
- A Secure Token is a hardware authentication token required for Touch ID enrollment on Mac laptops
- A Secure Token is a VPN authentication certificate issued by Apple to verify enterprise Mac enrollment
Correct answer: A Secure Token is a cryptographic token granted to user accounts that enables them to unlock FileVault-encrypted volumes — required for FileVault enablement and MDM bootstrap token generation on Apple silicon
Secure Tokens are cryptographic grants that allow user accounts to unlock FileVault-encrypted APFS volumes. On Apple silicon Macs, at least one Secure Token holder is required to generate a Bootstrap Token for MDM-managed FileVault management.
Secure Token mechanics: Introduced with APFS. A user with Secure Token can enable FileVault and grant Secure Tokens to other users. When a new admin user is created at Setup Assistant, they get a Secure Token. Adding users via command line ('dscl . create') does NOT grant Secure Token — use 'sysadminctl -addUser' or MDM. Bootstrap Token: A Secure Token-encrypted token escrowed with MDM, allows MDM to grant Secure Tokens to new users and unlock FileVault before any user logs in (needed for management at startup). 'sysadminctl -secureTokenStatus username' checks token status. On MDM-managed Apple silicon Macs, ensure the Bootstrap Token is escrowed: 'profiles status -type bootstraptoken'.
ACSP User Accounts and Security 2
What is the difference between a Standard user account and an Administrator account in macOS?