Apple Certified Support Professional (ACSP) — Questions and Answers

Question 1: What is the function of the 'grep' command in macOS Terminal?

Find files by name in the file system
Search text using patterns and display matching lines from files or input (Correct answer)
Copy files matching a specific pattern to another directory
Display file contents with line numbers

Correct answer: Search text using patterns and display matching lines from files or input

'grep' (Global Regular Expression Print) searches through text files or piped input for lines matching a specified pattern, printing those matching lines to the terminal output.

Question 2: What does the 'noatime' mount option do when applied to an APFS or HFS+ volume on macOS?

Prevents access-time timestamps from being updated when files are read (Correct answer)
Prevents new files from being created
Stops Time Machine from backing up the volume
Disables APFS snapshots

Correct answer: Prevents access-time timestamps from being updated when files are read

The `noatime` option stops macOS from writing an updated access-time to disk every time a file is read, reducing unnecessary write operations.

Question 3: What is the significance of a Mac showing an Apple logo with a progress bar that stops partway through on startup?

A partially complete progress bar is normal — it pauses while macOS checks for software updates before completing boot
The startup process has stalled, possibly due to a failing startup item, kernel extension conflict, or file system issue; booting in Safe Mode helps diagnose by disabling third-party items (Correct answer)
The progress bar stopping means the Mac is installing a macOS update and should not be interrupted
A stalled progress bar always indicates a failing hard drive and the Mac requires immediate data recovery

Correct answer: The startup process has stalled, possibly due to a failing startup item, kernel extension conflict, or file system issue; booting in Safe Mode helps diagnose by disabling third-party items

A startup progress bar that stops partway indicates macOS is hanging during startup — typically caused by a failing Launch Daemon, problematic kernel extension, file system error, or hardware issue. Safe Mode (bypasses third-party items) helps isolate the cause.

Question 4: How can you configure a Mac to automatically restart after a power failure?

Via a startup script in /etc/rc.local
Only via Energy Saver in System Settings
Both Energy Saver GUI setting and `pmset -a autorestart 1` work (Correct answer)
Only via the `pmset` command in Terminal

Correct answer: Both Energy Saver GUI setting and `pmset -a autorestart 1` work

Auto-restart after power failure can be enabled in Energy Saver/Battery settings GUI or via `sudo pmset -a autorestart 1` in Terminal.

Question 5: In the command line, a technician needs to forcefully terminate a non-responsive process with the Process ID (PID) 501. The standard `kill 501` command did not work because the process is ignoring the request. Which command is the most effective next step to immediately stop the process?

kill -15 501
kill -9 501 (Correct answer)
kill -1 501
pkill 501

Correct answer: kill -9 501

The `kill -9 501` command sends the SIGKILL signal to the process. This is a special signal that cannot be caught or ignored by the process, forcing the kernel to terminate it immediately. The default `kill` command (and `kill -15`) sends a SIGTERM signal, which is a polite request to terminate that can be ignored. `pkill` targets processes by name, not PID, and `kill -1` (SIGHUP) is used to signal a hangup.

Question 6: What is 'Activation Lock' on Apple silicon Macs, and how does it affect repair and resale?

Activation Lock ties the Mac to an Apple ID via the Secure Enclave; the Mac cannot be set up until unlocked by the original owner or via Apple Business Manager (Correct answer)
Activation Lock prevents software installation unless the Mac is activated through Apple's developer portal
Activation Lock is a screen lock that activates after multiple failed login attempts
Activation Lock prevents unauthorized hardware modifications by locking the T2/M-series chip configuration

Correct answer: Activation Lock ties the Mac to an Apple ID via the Secure Enclave; the Mac cannot be set up until unlocked by the original owner or via Apple Business Manager

Activation Lock on Macs (via Find My) ties the Mac's Secure Enclave to the owner's Apple ID. If Find My is enabled and the Mac is erased, setup requires the original owner's Apple ID credentials — preventing use of a stolen Mac after erasure.

Question 7: What is the purpose of the 'Preboot' volume in an APFS container on Apple silicon Macs?

It acts as a swap partition for virtual memory
It contains boot data and system policy for each installed macOS volume (Correct answer)
It stores Time Machine snapshots
It holds kernel extensions for third-party software

Correct answer: It contains boot data and system policy for each installed macOS volume

The Preboot volume stores per-OS boot files, cryptographic measurements, and system security policy needed to start each macOS installation.

Question 8: A user's application consistently crashes at launch after a macOS update. Which folder should you check first for potentially corrupt preference files?

/System/Library/Frameworks/
/Library/Application Support/
~/Library/Preferences/ (Correct answer)
~/Library/Caches/

Correct answer: ~/Library/Preferences/

Application preference files (.plist) stored in ~/Library/Preferences/ can become corrupt after system updates, causing app crashes. Removing or renaming the app's .plist file forces it to regenerate fresh preferences.

Question 9: An IT administrator needs to test whether TCP port 443 is open on a remote server from a Mac. Which command is most appropriate?

traceroute server.example.com 443
nslookup server.example.com 443
ping -p 443 server.example.com
nc -zv server.example.com 443 (Correct answer)

Correct answer: nc -zv server.example.com 443

The netcat (nc) command with -zv flags performs a port scan verbosely without sending data, confirming whether TCP port 443 is open.

Question 10: What is the function of the 'networksetup -setdnsservers' command in macOS Terminal?

Flushes the DNS cache for a specific interface
Exports DNS settings to a configuration file
Tests DNS resolution speed for a list of servers
Assigns custom DNS server addresses to a specified network service (Correct answer)

Correct answer: Assigns custom DNS server addresses to a specified network service

The `networksetup -setdnsservers <NetworkService> <dns1> <dns2>` command sets the DNS servers for the specified network interface from the command line.

Question 11: A Mac supports up to how many APFS volumes within a single APFS container before performance may be impacted?

Up to 8 volumes
There is no defined limit; performance depends on available storage (Correct answer)
Up to 16 volumes
Exactly 4 volumes

Correct answer: There is no defined limit; performance depends on available storage

APFS imposes no hard limit on the number of volumes per container, but all volumes share the same pool of free space and I/O resources.

Question 12: During an Internet Recovery startup, what URL does the Mac contact to download the recovery environment?

swscan.apple.com (Correct answer)
updates.cdn-apple.com
mesu.apple.com
apple.com/support/recovery

Correct answer: swscan.apple.com

Internet Recovery contacts Apple's servers at swscan.apple.com (among other Apple CDN hosts) to download a minimal recovery image.

Question 13: What is the purpose of the Network Diagnostics tool in macOS?

It scans for nearby Wi-Fi networks and rates signal strength
It tests maximum bandwidth between the Mac and the router
It steps through network layers to identify where connectivity fails (Correct answer)
It resets all network settings to factory defaults

Correct answer: It steps through network layers to identify where connectivity fails

Network Diagnostics walks through ISP, Wi-Fi, router, DNS, and internet connectivity checks to pinpoint where a network issue exists.

Question 14: What does a flashing question mark folder displayed at Mac startup indicate?

The firmware needs an update
macOS cannot locate a valid startup disk (Correct answer)
A RAM module failure was detected
FileVault encryption is incomplete

Correct answer: macOS cannot locate a valid startup disk

A flashing question mark folder means macOS cannot find a bootable system volume, which may indicate a disconnected, corrupted, or erased startup drive.

Question 15: A user's Mac gets stuck on a spinning globe during startup. What does this indicate?

The Mac is attempting to boot from a network server via NetBoot or network startup (Correct answer)
The Mac's internal SSD has failed and needs replacement
macOS is performing a background update automatically
The Bluetooth keyboard is not paired and the Mac is waiting for input

Correct answer: The Mac is attempting to boot from a network server via NetBoot or network startup

A spinning globe at startup means the Mac is attempting to boot from a network startup source such as NetBoot, NetInstall, or NetRestore.

Question 16: A user wants to prevent a specific app from launching at login without deleting it. Where is the most appropriate place to manage this in macOS Ventura and later?

Activity Monitor's Energy tab
System Settings > General > Login Items & Extensions (Correct answer)
Finder > Applications folder
Terminal using launchctl remove

Correct answer: System Settings > General > Login Items & Extensions

In macOS Ventura and later, Login Items & Extensions in System Settings is the unified location to enable or disable apps and background items that launch at login.

Question 17: How does Time Machine determine which files to back up in each hourly backup?

It scans the entire drive alphabetically and checks modification dates
It compares a full MD5 hash of every file against the previous backup
It uses FSEvents to track files that have changed since the last backup (Correct answer)
It backs up all files modified in the last 24 hours regardless of previous backups

Correct answer: It uses FSEvents to track files that have changed since the last backup

Time Machine uses the FSEvents framework, which tracks file system changes in real time, to efficiently identify only the files that have changed since the last backup — avoiding a full scan of the drive.

Question 18: A support professional is analyzing system performance in Activity Monitor and wants to understand the relationship between different processes. They suspect a helper tool is being launched by a main application. How can they change the view in Activity Monitor to see these parent-child process relationships?

Click the 'Memory' tab to see process memory allocation.
Select 'Windowed Processes' from the View menu.
Select 'All Processes, Hierarchically' from the View menu. (Correct answer)
Double-click on a process to open the 'Inspect' window.

Correct answer: Select 'All Processes, Hierarchically' from the View menu.

The 'All Processes, Hierarchically' view in Activity Monitor is specifically designed to show the parent-child relationships between processes. This allows an administrator to see which processes were launched by others, which is useful for troubleshooting. The other options provide different types of information but do not display this hierarchical structure.

Question 19: What does enabling the 'Show scroll bars' setting set to 'Always' affect in macOS?

Scroll bars are permanently visible in all scrollable areas (Correct answer)
The dock auto-hides when scrolling
It enables keyboard scrolling shortcuts
Scroll bars appear only when using a mouse

Correct answer: Scroll bars are permanently visible in all scrollable areas

Setting 'Show scroll bars' to 'Always' in Appearance settings makes scroll bars permanently visible, which is useful for accessibility and navigation clarity.

Question 20: A technician uses `diskutil secureErase freespace 0 /dev/disk1s1` before reinstalling macOS. What does this command do?

Performs a DoD 7-pass erase of all data on disk1s1
Writes zeros to only the free (unused) space on the specified APFS volume (Correct answer)
Reformats the partition table to GPT
Erases the entire disk including all partitions

Correct answer: Writes zeros to only the free (unused) space on the specified APFS volume

The `secureErase freespace 0` option writes a single pass of zeros only to the free space on the volume, not to areas with existing data.

Question 21: What is the purpose of DNS (Domain Name System) in macOS network configuration?

DNS encrypts network traffic between the Mac and internet servers for security
DNS translates human-readable domain names (like apple.com) into numeric IP addresses that computers use to communicate (Correct answer)
DNS monitors network traffic and blocks access to malicious websites
DNS assigns IP addresses to devices on the local network dynamically

Correct answer: DNS translates human-readable domain names (like apple.com) into numeric IP addresses that computers use to communicate

DNS resolves domain names to IP addresses. When a Mac connects to apple.com, it first queries a DNS server to get the IP address (e.g., 17.253.144.10), then connects to that IP. Without DNS, users would need to memorize numeric IP addresses.

Question 22: What is the macOS 'Accessibility' peripheral feature 'Switch Control' and who is it designed for?

Switch Control allows users with motor impairments to control the Mac using one or more switches (external buttons, head mouse, eye tracking) instead of a standard keyboard and mouse (Correct answer)
Switch Control is a Bluetooth feature that switches between multiple paired devices automatically
Switch Control cycles through network interfaces to find the best available connection automatically
Switch Control is a privacy feature that disables the mouse and keyboard for secure kiosk mode deployments

Correct answer: Switch Control allows users with motor impairments to control the Mac using one or more switches (external buttons, head mouse, eye tracking) instead of a standard keyboard and mouse

Switch Control is an Accessibility feature for users with severe motor impairments who cannot use a standard keyboard or mouse. It enables full Mac control using one or more switch interfaces — physical buttons, sip-and-puff devices, head tracking cameras, or eye gaze systems.

Question 23: A user reports that Time Machine backups have been failing with an error indicating the backup disk needs to be repaired. What should the technician do first?

Delete the Time Machine backup folder and let it recreate
Replace the disk immediately as it is failing
Erase and reformat the Time Machine disk, then start a new backup set
Use Disk Utility to run First Aid on the Time Machine backup disk (Correct answer)

Correct answer: Use Disk Utility to run First Aid on the Time Machine backup disk

Running First Aid in Disk Utility repairs minor file system errors on the Time Machine disk, which often resolves backup failures without requiring a full erase.

Question 24: A Mac running macOS Sonoma shows 'Your Mac restarted because of a problem' repeatedly but only after connecting a specific USB hub. What is the best diagnostic approach?

Reset NVRAM and reconnect the hub to see if the issue persists
Review the kernel panic report to identify the loaded kext or driver associated with the USB hub, then update or remove it (Correct answer)
Reinstall macOS to ensure all USB drivers are at the correct version
Run Apple Diagnostics to identify a hardware fault in the USB controller

Correct answer: Review the kernel panic report to identify the loaded kext or driver associated with the USB hub, then update or remove it

Kernel panic reports list all loaded kernel extensions at the time of the crash; identifying the USB-related kext in the backtrace points to the driver that needs to be updated or removed.

Question 25: A user wants to exclude a large folder of virtual machine images from their Time Machine backups to save space. They add the folder to the exclusion list in System Settings. What effect does this have on the existing backups of that folder?

The folder is archived in existing backups to a compressed format to save space retroactively.
Time Machine prompts the user to delete the folder from previous backups during the next backup cycle.
The folder remains in all existing backups but will be omitted from all future backups. (Correct answer)
The folder is immediately deleted from all previous backup snapshots.

Correct answer: The folder remains in all existing backups but will be omitted from all future backups.

Adding a folder to the Time Machine exclusion list only affects future backups. All versions of the folder that have already been backed up will remain on the backup drive until they are eventually deleted as part of Time Machine's normal process of removing the oldest backups when space is needed.

Question 26: Which VPN protocols can you manually configure in Mac System Settings?

WireGuard, Cisco IPSec, and IKEv2
L2TP over IPSec, Cisco IPSec, and IKEv2 (Correct answer)
L2TP over IPSec, SSTP, and IKEv2
L2TP over IPSec, Cisco IPSec, and OpenVPN

Correct answer: L2TP over IPSec, Cisco IPSec, and IKEv2

Explanation: For information about the VPN settings you need to enter, contact the your organization’s network administrator or your VPN service provider. Continue to study resources related to the following learning objective: Configure, manage, and use VPN settings on iPhone, iPad, and Mac.

Question 27: A technician needs to ensure that a specific Login Item launches for all users on a shared Mac, not just a single user. What is the correct approach?

Place the app in /Library/LaunchAgents as a LaunchAgent plist (Correct answer)
Add the item in Users & Groups > Login Items for each user manually
Use Spotlight to set it as a startup item
Add it to System Preferences > General for all users

Correct answer: Place the app in /Library/LaunchAgents as a LaunchAgent plist

Placing a LaunchAgent .plist in /Library/LaunchAgents makes it run at login for all users on the system.

Question 28: Where are application bundles (.app files) stored for all users on a Mac versus only the current user?

/System/Applications/ for all users and /Applications/ for the current user
/Library/Apps/ for all users and ~/Library/Apps/ for the current user
/Applications/ for all users and ~/Applications/ for the current user only (Correct answer)
/usr/applications/ for all users and /home/apps/ for the current user

Correct answer: /Applications/ for all users and ~/Applications/ for the current user only

Applications in /Applications/ are available to all users on the Mac. Applications installed in ~/Applications/ (the user's home folder Applications directory) are only available to that specific user.

Question 29: What is the purpose of NVRAM/PRAM on Intel Macs and how do you reset it?

NVRAM is the firmware memory where macOS is stored; resetting it reinstalls macOS
NVRAM stores small amounts of data the Mac needs quickly at startup (time zone, startup disk, display resolution, speaker volume); reset by holding Cmd+Option+P+R at startup (Correct answer)
NVRAM stores the Mac's full system settings and resetting it removes all user preferences
NVRAM controls the Secure Enclave settings; resetting it clears all Touch ID fingerprints

Correct answer: NVRAM stores small amounts of data the Mac needs quickly at startup (time zone, startup disk, display resolution, speaker volume); reset by holding Cmd+Option+P+R at startup

NVRAM (Non-Volatile RAM) on Intel Macs stores settings needed quickly at startup including the selected startup disk, screen resolution, speaker volume, and kernel panic information. Hold Cmd+Option+P+R at startup for at least 20 seconds (or until the startup sound plays twice on older Macs) to reset it.

Question 30: What is the 'Captive Network Assistant' in macOS and when does it appear?

It assists in configuring complex enterprise network authentication settings
It appears when the Mac cannot connect to Wi-Fi and guides the user through troubleshooting steps
It detects when the Mac is connected to a monitored network and warns the user
It automatically detects captive portals (hotel/airport Wi-Fi login pages) and opens a browser window to complete authentication (Correct answer)

Correct answer: It automatically detects captive portals (hotel/airport Wi-Fi login pages) and opens a browser window to complete authentication

When macOS detects it is connected to a network but cannot reach the internet (typical of captive portals at hotels, airports, and coffee shops), it automatically launches the Captive Network Assistant — a limited browser window for completing the Wi-Fi login/authentication page.

Question 31: Which command would a technician use to check and display the network routing table on a Mac?

ifconfig -a
netstat -r (Correct answer)
ping -r
route show

Correct answer: netstat -r

'netstat -r' displays the kernel routing table, showing how the Mac routes network traffic to different destinations, including the default gateway and any static routes.

Question 32: A Mac fails to obtain an IP address via DHCP over Ethernet but works fine on Wi-Fi on the same network. What should be checked first?

The Mac's firewall blocking DHCP
DNS server configuration
DHCP lease time settings on the router
The Ethernet cable and physical connection (Correct answer)

Correct answer: The Ethernet cable and physical connection

A physical layer issue such as a faulty cable or unplugged connection is the most common reason Ethernet fails when Wi-Fi on the same network succeeds.

Question 33: Which of the following best describes the primary security benefit of the Signed System Volume (SSV) feature in modern versions of macOS?

It sandboxes all third-party applications, restricting their access to system files and user data.
It prevents unauthorized users from logging in by requiring a cryptographic key stored in the Secure Enclave.
It encrypts the entire startup volume, making the data unreadable if the drive is physically removed.
It uses cryptographic hashes to create a verifiable, read-only system volume that protects against tampering and malicious modification. (Correct answer)

Correct answer: It uses cryptographic hashes to create a verifiable, read-only system volume that protects against tampering and malicious modification.

The Signed System Volume (SSV) feature cryptographically seals the system volume by creating hashes for all system content. At runtime, the kernel verifies these hashes to ensure the integrity of the operating system and rejects any data that has been tampered with or lacks a valid signature from Apple.

Question 34: When using an Apple Studio Display connected to a MacBook Pro, a user reports the display's built-in camera is not recognized. What should you check first?

Camera permissions in System Settings > Privacy & Security
If the display's USB-C cable is fully seated in the Thunderbolt port (Correct answer)
Whether the user has enabled Screen Time restrictions
Whether Thunderbolt firmware is up to date on the display

Correct answer: If the display's USB-C cable is fully seated in the Thunderbolt port

The Studio Display's camera, speaker, and microphone only function when connected via the included Thunderbolt cable that also carries data; a loose connection drops those devices.

Question 35: A user wants to receive Focus (Do Not Disturb) status automatically while using a specific app. Which macOS System Preferences section supports Focus filters per app?

Screen Time > App Limits
General > Focus
Mission Control > Dashboard
Notifications & Focus > Focus (Correct answer)

Correct answer: Notifications & Focus > Focus

Focus modes with per-app filters are configured in System Preferences > Notifications & Focus > Focus.

Question 36: Which Mac resource displays network interface status in a dynamic list?

Network settings (Correct answer)
VPN settings
Internet Accounts settings
Wireless Diagnostics

Correct answer: Network settings

Explanation: Network settings on a Mac display network interface status in a dynamic list. Continue to study resources related to the following learning objective: Troubleshoot network locations on a Mac when a network interface isn’t working.

Question 37: What is the difference between USB-A, USB-C, and Thunderbolt 4 connectors in terms of physical compatibility and capability?

USB-A is the rectangular legacy connector (USB 2/3); USB-C is a small oval connector used for USB and Thunderbolt; Thunderbolt 4 uses the USB-C physical connector with 40Gbps bandwidth, video, power, and USB4 support (Correct answer)
USB-A supports faster charging than USB-C; Thunderbolt 4 supports only data transfer, not power delivery
Thunderbolt 4 uses a proprietary Apple connector different from USB-C on non-Apple hardware
USB-C and Thunderbolt 4 use identical cables and can be used interchangeably without any performance difference

Correct answer: USB-A is the rectangular legacy connector (USB 2/3); USB-C is a small oval connector used for USB and Thunderbolt; Thunderbolt 4 uses the USB-C physical connector with 40Gbps bandwidth, video, power, and USB4 support

USB-A is the flat rectangular legacy connector. USB-C is a symmetrical oval connector used for USB 2/3/4, Thunderbolt 3/4, DisplayPort Alt Mode, and Power Delivery. Thunderbolt 4 uses the USB-C physical connector but requires Thunderbolt-certified cables for full 40Gbps performance.

Question 38: Which macOS System Settings panel allows a user to create and switch between different network configurations for different environments?

Network Locations (Correct answer)
Sharing Profiles
Network Extensions
VPN Profiles

Correct answer: Network Locations

Network Locations in macOS allow users to save and switch between sets of network configurations for different environments such as home and office.

Question 39: A user is unable to boot their Mac from an external bootable installer. They are using a Mac with an Apple T2 Security Chip. What is the most likely cause of this issue?

The external drive is formatted as APFS.
The `createinstallmedia` command was run without `sudo`.
The PRAM needs to be reset.
The Startup Security Utility is configured to disallow booting from external media. (Correct answer)

Correct answer: The Startup Security Utility is configured to disallow booting from external media.

For Macs with the Apple T2 Security Chip, the default security setting prevents the computer from booting from external or removable media. This setting must be changed in the Startup Security Utility, which is accessible from macOS Recovery, to allow external booting.

Question 40: A Mac app crashes repeatedly with a 'SIGABRT' signal. What does this signal most commonly indicate?

Out-of-memory condition detected by the kernel
The app called abort() due to an internal assertion failure (Correct answer)
The app exceeded its sandbox file write limit
A network timeout forced the process to stop

Correct answer: The app called abort() due to an internal assertion failure

SIGABRT is typically triggered when an app calls abort() after detecting an unrecoverable internal error such as a failed assertion.

Question 41: Which macOS Recovery option should a support professional use when reinstalling macOS without erasing user data?

Erase Mac
Reinstall macOS from Recovery (Correct answer)
Erase All Content and Settings
Restore from Time Machine

Correct answer: Reinstall macOS from Recovery

Reinstalling macOS from Recovery replaces system files while leaving user data and apps intact, making it appropriate for corrupted system file scenarios.

Question 42: Which `find` command locates all `.log` files modified within the last 7 days under `/var/log`?

search /var/log -modified -7 -name '*.log'
locate /var/log -type f -mtime 7
find /var/log -name '*.log' -mtime -7 (Correct answer)
find /var/log -name '*.log' -atime 7

Correct answer: find /var/log -name '*.log' -mtime -7

`find` with `-mtime -7` matches files modified less than 7 days ago.

Question 43: A technician is using Disk Utility to troubleshoot a storage issue. They need to check for and repair errors in the file system structure of a volume. Which Disk Utility feature should they use?

Erase
First Aid (Correct answer)
Restore
Partition

Correct answer: First Aid

First Aid is the feature in Disk Utility designed to check a disk for errors and make repairs if necessary. It verifies and repairs the file system structure and permissions. Erase is for formatting a volume, Partition is for creating or modifying partitions, and Restore is for copying a volume from a source to a destination.

Question 44: Which protocol does macOS use by default to automatically discover printers, file shares, and other services on a local network without requiring manual configuration?

NetBIOS
SNMP
Bonjour (mDNS) (Correct answer)
LDAP

Correct answer: Bonjour (mDNS)

Bonjour uses multicast DNS (mDNS) and DNS-SD to advertise and discover services on a local network without a central server.

Question 45: How does FileVault on an Apple silicon Mac differ from FileVault on an Intel Mac?

Apple silicon uses software-only encryption; Intel Macs use hardware-accelerated encryption via the T2 chip
On Apple silicon, FileVault leverages the Secure Enclave for hardware-accelerated encryption tightly integrated with the user's login credentials from first boot (Correct answer)
Apple silicon Macs require an institutional recovery key; personal recovery keys are not supported
FileVault is optional on Intel Macs but cannot be disabled on Apple silicon Macs

Correct answer: On Apple silicon, FileVault leverages the Secure Enclave for hardware-accelerated encryption tightly integrated with the user's login credentials from first boot

Apple silicon Macs integrate data protection at the hardware level via the Secure Enclave, making FileVault encryption hardware-accelerated and tied to the user's login credential from the very first login. This is a deeper integration than the software-layer approach used on Intel Macs without a T2 chip.

Question 46: What does 'traceroute' show in macOS network diagnostics?

Traceroute shows each network hop (router) between the Mac and destination, with latency at each hop — revealing where packets are delayed or dropped along the path (Correct answer)
Traceroute tests all network interfaces simultaneously and shows which provides the fastest path to a destination
Traceroute shows the physical cable route that network traffic takes from the Mac to the destination server
Traceroute only works on local networks and cannot trace routes across the internet

Correct answer: Traceroute shows each network hop (router) between the Mac and destination, with latency at each hop — revealing where packets are delayed or dropped along the path

'traceroute hostname' (or 'traceroute -n IP_address' to skip DNS lookups) sends packets with incrementing TTL values, revealing each router hop with its IP/hostname and round-trip latency — showing exactly where high latency or packet loss occurs along the network path.

Question 47: What is the Apple Diagnostics tool and how do you access it on Apple silicon Macs?

Apple Diagnostics tests hardware components (logic board, memory, storage, wireless); on Apple silicon hold the Power button at startup, select Options, then Command + D after selecting the volume (Correct answer)
Apple Diagnostics is a third-party tool that must be downloaded from Apple's support website before running
Apple Diagnostics is only available during an Apple Authorized Service Provider appointment and cannot be run by end users
Apple Diagnostics is accessed by holding D during startup on both Intel and Apple silicon Macs identically

Correct answer: Apple Diagnostics tests hardware components (logic board, memory, storage, wireless); on Apple silicon hold the Power button at startup, select Options, then Command + D after selecting the volume

Apple Diagnostics (formerly Apple Hardware Test) tests Mac hardware. On Apple silicon Macs: press and hold Power button → startup options appear → hold Command+D to launch Apple Diagnostics. On Intel Macs: hold D at startup (or Option+D for internet-based diagnostics).

Question 48: Which macOS command-line tool can be used to flush the DNS cache?

networksetup -flushdns
ipconfig /flushdns
dscacheutil -flushcache && killall -HUP mDNSResponder (Correct answer)
nslookup -flush

Correct answer: dscacheutil -flushcache && killall -HUP mDNSResponder

On macOS, flushing the DNS cache requires clearing the local cache with dscacheutil and signaling mDNSResponder to reset.

Question 49: Which macOS feature allows you to create a network location that automatically switches proxy settings when moving between office and home networks?

VPN On Demand
Content Caching service
Wi-Fi preferred networks list
Network Locations in System Settings > Network (Correct answer)

Correct answer: Network Locations in System Settings > Network

Network Locations let users save distinct sets of network settings (including proxies) and switch between them manually or via scripts.

Question 50: What is the difference between 'Move to Trash' and 'Secure Empty Trash' in macOS?

Move to Trash compresses files, while Secure Empty Trash deletes them without compression
Move to Trash keeps files for 30 days; Secure Empty Trash deletes them immediately
Move to Trash only unlinks the file (space is recoverable); Secure Empty Trash overwrote data multiple times — though this feature was removed in El Capitan because SSDs make overwriting unreliable (Correct answer)
Move to Trash requires admin authorization; Secure Empty Trash does not

Correct answer: Move to Trash only unlinks the file (space is recoverable); Secure Empty Trash overwrote data multiple times — though this feature was removed in El Capitan because SSDs make overwriting unreliable

Standard trash deletion only removes directory entries (files are recoverable with tools). Secure Empty Trash overwrote file data, but Apple removed this feature in OS X El Capitan (10.11) because overwriting on SSDs and APFS volumes is unreliable — the file system may not write to the same physical blocks.

Question 51: Which file extension identifies a macOS Launch Agent or Launch Daemon configuration file?

.config
.plist (Correct answer)
.service
.daemon

Correct answer: .plist

Launch Agents and Launch Daemons are configured using property list (.plist) files stored in LaunchAgents or LaunchDaemons directories.

Question 52: Which keyboard shortcut quickly opens Accessibility Options on macOS?

Option+F1
Control+Option+Command+8
Option+Command+F5 (Correct answer)
Shift+Command+A

Correct answer: Option+Command+F5

Pressing Option+Command+F5 opens the Accessibility Options dialog, providing quick access to features like VoiceOver, Zoom, and Sticky Keys.

Question 53: A technician needs to revive a Mac with Apple silicon that won't turn on at all. Which tool and connection are required?

Apple Configurator 2 connected via USB-C to the appropriate port on the target Mac (Correct answer)
Apple Remote Desktop over the local network
A bootable macOS USB drive connected to any USB port
Target Disk Mode with a Thunderbolt cable to another Mac

Correct answer: Apple Configurator 2 connected via USB-C to the appropriate port on the target Mac

Apple Configurator 2 can revive or restore Apple silicon Macs by connecting a USB-C cable from a host Mac to the specific DFU port on the target Mac.

Question 54: A user's supervised iPhone shows 'Remote Management' in Settings but they cannot remove it. What configuration ensures this?

A configuration profile distributed via email
Manual pairing with Apple Configurator without supervision
User Enrollment profile installed manually
MDM enrollment profile installed via ADE with a non-removable flag (Correct answer)

Correct answer: MDM enrollment profile installed via ADE with a non-removable flag

ADE-based MDM enrollment profiles are flagged as non-removable, preventing users from unenrolling through Settings.

Question 55: What is Declarative Device Management (DDM), introduced by Apple to modernize the MDM protocol?

A replacement for APNs that uses direct TCP connections
A model where devices autonomously apply and maintain configurations without constant server polling (Correct answer)
A real-time remote screen monitoring capability
A new enrollment protocol replacing Automated Device Enrollment

Correct answer: A model where devices autonomously apply and maintain configurations without constant server polling

DDM shifts the management model so devices proactively apply declared configurations and report status autonomously, reducing the need for repeated MDM server polling and commands.

Question 56: What is the difference between a Time Machine 'local snapshot' and a full Time Machine backup to an external drive?

Local snapshots require FileVault, while external backups work with any configuration
Local snapshots are compressed, while external backups store files at full size
Local snapshots only cover the user's home folder, while external backups cover the entire drive
Local snapshots are stored on the Mac's internal drive using APFS, while full backups go to the designated external/network backup destination (Correct answer)

Correct answer: Local snapshots are stored on the Mac's internal drive using APFS, while full backups go to the designated external/network backup destination

Time Machine creates local snapshots on the Mac's own APFS volume using APFS snapshot technology, storing them internally. These provide fast local recovery but are separate from (and supplementary to) backups sent to an external drive or network destination.

Question 57: A user's iPhone shows full Wi-Fi signal bars but they are connected to a captive portal network at a hotel. The Mac shows the same issue. Which approach resolves captive portal authentication?

Toggle Airplane Mode on and off
Forget the network and re-join it
Open a browser and navigate to any HTTP (not HTTPS) page to trigger the portal redirect (Correct answer)
Change the DNS server to 1.1.1.1

Correct answer: Open a browser and navigate to any HTTP (not HTTPS) page to trigger the portal redirect

Captive portals intercept unencrypted HTTP requests to redirect to the login page; navigating to an http:// URL (not https://) triggers the redirect that HTTPS would block.

Question 58: Which macOS feature restricts which apps can access sensitive resources such as the camera, microphone, and contacts by maintaining a database of per-app permissions?

Notarization
Gatekeeper
System Integrity Protection (SIP)
Transparency, Consent, and Control (TCC) (Correct answer)

Correct answer: Transparency, Consent, and Control (TCC)

The TCC (Transparency, Consent, and Control) framework manages and enforces per-app privacy permissions for sensitive data categories like camera, microphone, and contacts.

Question 59: What is the purpose of the macOS 'Printer Reset' option and when should a technician use it?

Printer Reset (Reset printing system) in macOS removes all printers, print queues, and printer drivers, allowing a fresh start when print queues are stuck or printer drivers are corrupt (Correct answer)
Printer Reset removes only the selected printer's queue and driver, leaving others unaffected
Printer Reset is used to restore factory default settings on a network printer via macOS
Printer Reset restarts the print spooler service without removing any printer configurations

Correct answer: Printer Reset (Reset printing system) in macOS removes all printers, print queues, and printer drivers, allowing a fresh start when print queues are stuck or printer drivers are corrupt

Right-clicking in the empty area of the Printers list in System Settings > Printers & Scanners and choosing 'Reset printing system' removes ALL printers, print queues, drivers, and print jobs, completely resetting the macOS printing subsystem — useful when print queues are stuck or drivers are corrupt.

Question 60: Which Apple tool provides a graphical interface for creating, signing, and installing configuration profiles and managing supervised Apple devices?

Profile Manager
System Preferences
Xcode Instruments
Apple Configurator 2 (Correct answer)

Correct answer: Apple Configurator 2

Apple Configurator 2 is a free macOS app that lets administrators prepare, supervise, and manage Apple devices and configuration profiles without a full MDM server.

Question 61: What is a VPN (Virtual Private Network) and what types does macOS natively support?

A VPN creates an encrypted tunnel for network traffic; macOS natively supports IKEv2, IPSec, and L2TP over IPSec VPN protocols (Correct answer)
A VPN monitors and filters all network traffic for security; macOS supports only third-party VPN solutions
A VPN is a local network virtualization technology; macOS supports only Apple's proprietary VPN protocol
A VPN creates a private Wi-Fi hotspot; macOS supports WPA3-Personal and WPA3-Enterprise

Correct answer: A VPN creates an encrypted tunnel for network traffic; macOS natively supports IKEv2, IPSec, and L2TP over IPSec VPN protocols

A VPN encrypts and tunnels network traffic through a private server. macOS natively supports IKEv2, Cisco IPSec, and L2TP over IPSec VPN connections in System Settings > Network > Add VPN Configuration, without requiring third-party client apps.

Question 62: A remote worker needs to connect to their corporate network via VPN. The IT department has provided them with a server address, a username, a password, and a 'shared secret'. Which built-in VPN type in macOS Network settings should they configure?

L2TP over IPSec
IKEv2
OpenVPN (Correct answer)
Cisco IPSec

Correct answer: OpenVPN

The L2TP over IPSec configuration in macOS natively includes fields for a server address, account name (username), password, and a 'Shared Secret' (also known as a pre-shared key). This matches the credentials provided by the IT department.

Question 63: Which directory stores Launch Agents that run in the context of the currently logged-in user?

~/Library/LaunchAgents/ (Correct answer)
/etc/launchd/
/Library/LaunchDaemons/
/System/Library/LaunchDaemons/

Correct answer: ~/Library/LaunchAgents/

Launch Agents in ~/Library/LaunchAgents/ run with the privileges of the logged-in user, making them user-scoped background tasks.

Question 64: When migrating data from an old Mac to a new Mac using Migration Assistant, which connection method provides the fastest transfer speed?

USB-A cable
Ethernet
Thunderbolt cable (Correct answer)
Wi-Fi

Correct answer: Thunderbolt cable

A Thunderbolt cable provides the highest bandwidth (up to 40 Gb/s), making it the fastest option for Migration Assistant transfers between two Macs.

Question 65: A technician needs to enable journaling on an HFS+ volume via Terminal. Which command accomplishes this?

diskutil enableJournal /dev/disk2s1 (Correct answer)
diskutil repairVolume /dev/disk2s1
fsck_hfs -j /dev/disk2s1
hdiutil journal enable /dev/disk2s1

Correct answer: diskutil enableJournal /dev/disk2s1

The `diskutil enableJournal` command enables HFS+ journaling on the specified volume, improving crash recovery.

Question 66: How does macOS handle Managed Open In to prevent data leakage between managed and unmanaged apps?

Managed Open In prevents any file from being opened in more than one application on a managed device
Managed Open In (Open From/Open In restrictions) prevents managed app data from being opened in unmanaged apps and vice versa, enforced via MDM policy to separate corporate and personal data (Correct answer)
Managed Open In is a macOS Ventura feature that replaces the older App Sandbox for MDM-managed apps
Managed Open In is an MDM restriction that prevents all file sharing between apps regardless of management status

Correct answer: Managed Open In (Open From/Open In restrictions) prevents managed app data from being opened in unmanaged apps and vice versa, enforced via MDM policy to separate corporate and personal data

Managed Open In (a corporate data separation feature set via MDM) controls the flow of documents between managed and unmanaged apps — documents from managed sources (corporate email, managed apps) cannot be opened in personal/unmanaged apps, preventing accidental corporate data leakage.

Question 67: A technician needs to view a live, continuous stream of all new system and application log messages as they are generated to diagnose an intermittent issue. Which command provides this real-time view into the macOS unified logging system?

tail -f /var/log/system.log
cat /var/log/syslog
log show --last 1m
log stream (Correct answer)

Correct answer: log stream

The `log stream` command taps directly into the macOS unified logging system and displays messages from all subscribed processes in real-time as they are created. While `tail -f` was used for legacy log files, it does not work with the modern unified logging database. `log show` is used for querying historical logs, not for live streaming.

Question 68: What is iCloud Drive's 'Optimize Mac Storage' feature and what risk does it introduce?

It moves files to external storage while keeping shortcuts locally
It automatically deletes duplicate files found in iCloud Drive
It removes local copies of older iCloud files to free disk space, but files are unavailable without internet (Correct answer)
It compresses all local files to reduce disk usage while keeping them accessible offline

Correct answer: It removes local copies of older iCloud files to free disk space, but files are unavailable without internet

Optimize Mac Storage removes local copies of older or less-used iCloud Drive files when disk space is low, keeping only the file stub (cloud icon) locally. Files must be re-downloaded from iCloud when accessed, requiring internet connectivity.

Question 69: In macOS, where would an administrator configure which apps are allowed to use the Mac's microphone?

Sound > Input
Security & Privacy > Privacy > Microphone (Correct answer)
Accessibility > Audio
Users & Groups > Login Items

Correct answer: Security & Privacy > Privacy > Microphone

App microphone permissions are managed in Security & Privacy > Privacy > Microphone.

Question 70: A technician is preparing to perform a clean installation of macOS Sonoma on multiple Macs. They have downloaded the installer from the App Store and want to create a bootable installer on a USB drive named 'MyVolume'. Which of the following is the correct Terminal command to accomplish this?

sudo /Applications/Install\ macOS\ Sonoma.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume (Correct answer)
sudo installer -pkg /Applications/Install\ macOS\ Sonoma.app -target /Volumes/MyVolume
dd if=/Applications/Install\ macOS\ Sonoma.app of=/Volumes/MyVolume
createinstallmedia --volume /Volumes/MyVolume --applicationpath /Applications/Install\ macOS\ Sonoma.app

Correct answer: sudo /Applications/Install\ macOS\ Sonoma.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume

The correct command to create a bootable macOS installer using the installer app located in the Applications folder is `sudo /Applications/Install\ macOS\ Sonoma.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume`. The other commands are incorrectly formatted or use different utilities not intended for this specific purpose.

Question 71: An organization wants to prevent employees from using external drives for Time Machine backups and restrict backups to an approved network share. Which tool is used to enforce this policy?

System Integrity Protection (SIP)
Mobile Device Management (MDM) with a Time Machine configuration profile (Correct answer)
Apple Configurator 2
FileVault

Correct answer: Mobile Device Management (MDM) with a Time Machine configuration profile

An MDM server can deploy a Time Machine configuration profile that restricts backup destinations to approved network volumes and disables use of local external drives.

Question 72: What is the difference between 2.4GHz and 5GHz Wi-Fi bands in terms of macOS network performance?

2.4GHz is required for Apple devices; 5GHz is for Windows and Android only
2.4GHz and 5GHz perform identically; the difference is only in power consumption
5GHz offers higher speeds and less interference but shorter range; 2.4GHz offers longer range but slower speeds and more interference from other devices (Correct answer)
5GHz works only outdoors; 2.4GHz is required for indoor use

Correct answer: 5GHz offers higher speeds and less interference but shorter range; 2.4GHz offers longer range but slower speeds and more interference from other devices

5GHz Wi-Fi provides faster speeds (up to Wi-Fi 6 and 6E standards) and less interference (fewer competing devices use 5GHz) but has shorter range and worse penetration through walls. 2.4GHz travels farther through obstacles but is crowded and slower.

Question 73: What does the 'Screen Sharing' feature in macOS enable, and what protocol does it use?

Screen Sharing uses Apple's proprietary Remote Desktop Protocol exclusive to macOS and cannot be accessed from Windows or Linux
Screen Sharing only allows viewing the screen remotely, not controlling the keyboard and mouse
Screen Sharing encrypts the session end-to-end and requires a valid Apple ID on both ends
Screen Sharing allows remote viewing and control of a Mac's screen from another Mac or VNC client; it uses the VNC (Virtual Network Computing) protocol over TCP port 5900 (Correct answer)

Correct answer: Screen Sharing allows remote viewing and control of a Mac's screen from another Mac or VNC client; it uses the VNC (Virtual Network Computing) protocol over TCP port 5900

macOS Screen Sharing uses the VNC protocol (port 5900), making it compatible with any VNC client. Apple's own Screen Sharing app and Apple Remote Desktop provide enhanced features, but any VNC client (RealVNC, TigerVNC, etc.) can connect to a Mac with Screen Sharing enabled.

Question 74: Which command would you use to change file permissions in macOS Terminal?

chgrp
chown
chmod (Correct answer)
ls -l

Correct answer: chmod

'chmod' (change mode) modifies the read, write, and execute permissions on files and directories. Permissions can be set using numeric (octal) notation like 755 or symbolic notation like u+x.

Question 75: Brian is trying to share his Personal Hotspot with Aga’s Mac. It isn’t working, and he asks you for help. You verify that his iPhone has the latest version of iOS and Personal Hotspot is turned on. Which troubleshooting step should Brian try next?

Turn off Low Power Mode.
Set the Allow Others to Join option to Ask.
Tap Settings > General > Transfer or Reset > Reset > Reset Network Settings. (Correct answer)
Tap Settings > Personal Hotspot, then turn on Maximize Compatibility.

Correct answer: Tap Settings > General > Transfer or Reset > Reset > Reset Network Settings.

Explanation: Resetting network settings on Brian’s iPhone is an appropriate next troubleshooting step. Continue to study resources related to the following learning objective: Troubleshoot Personal Hotspot connectivity issues.

Question 76: Which command-line tool in macOS can be used to list available printers and their status from the Terminal?

printutil
system_profiler SPPrintersDataType only
lpstat -p (Correct answer)
lsusb --printers

Correct answer: lpstat -p

`lpstat -p` lists all configured printers and indicates whether each is enabled or disabled.

Question 77: What is Thunderbolt daisy-chaining and how many devices can be connected in a chain?

Thunderbolt daisy-chaining is not supported on Macs with Apple silicon — only USB hubs are supported
Thunderbolt supports daisy-chaining of 3 devices maximum; additional devices require a hub or dock
Thunderbolt allows up to 6 devices to be daisy-chained in a series from a single Thunderbolt port, with each device passing the Thunderbolt bus to the next device in the chain (Correct answer)
Thunderbolt daisy-chaining allows unlimited devices but bandwidth is divided equally among all connected devices

Correct answer: Thunderbolt allows up to 6 devices to be daisy-chained in a series from a single Thunderbolt port, with each device passing the Thunderbolt bus to the next device in the chain

Thunderbolt supports daisy-chaining up to 6 devices per Thunderbolt port (plus the Mac = 7 devices total in the chain). Each device in the chain must have two Thunderbolt ports — one for input and one to pass the bus to the next device.

Question 78: When a macOS system volume is mounted as 'read-only' after a failed update, what underlying technology enforces this protection?

APFS snapshots
FileVault encryption
System Integrity Protection only
Signed System Volume (SSV) (Correct answer)

Correct answer: Signed System Volume (SSV)

The Signed System Volume (SSV) cryptographically seals the system volume, and macOS mounts it read-only to protect its integrity.

Question 79: During a diagnostic session, a MacBook Pro passes all Apple Diagnostics tests but the customer reports the fans run loudly under light load. What is the most appropriate next step?

Tell the customer the Mac is functioning normally since diagnostics passed
Use a third-party fan control app to limit fan speed
Immediately replace the thermal module
Check SMC sensor readings via system profiler or MRI, and inspect for blocked vents (Correct answer)

Correct answer: Check SMC sensor readings via system profiler or MRI, and inspect for blocked vents

Loud fans with light load suggest thermal sensor irregularities or blocked airflow; checking SMC sensor data and physical vents is the correct diagnostic path.

Question 80: What happens to APFS snapshots created by Time Machine when you restore from one in macOS Recovery?

Snapshots are transferred to an external drive before restoration begins
Only the selected files are restored without affecting the rest of the system
The Mac rolls back the entire volume to that snapshot's state, discarding changes made after it (Correct answer)
All snapshots are deleted after restoration

Correct answer: The Mac rolls back the entire volume to that snapshot's state, discarding changes made after it

Restoring from an APFS snapshot rolls the entire volume back to the exact state captured at that point in time, removing any subsequent changes.

Question 81: A MacBook Pro connects to Wi-Fi but cannot reach the internet. The IP address shown is 169.254.x.x. What does this indicate?

The router assigned a static IP
DHCP failed and the Mac self-assigned a link-local address (Correct answer)
The DNS server is unreachable
IPv6 is disabled on the network

Correct answer: DHCP failed and the Mac self-assigned a link-local address

A 169.254.x.x address is an APIPA (Automatic Private IP Addressing) self-assigned address, indicating the DHCP server did not respond.

Question 82: A user's Mac with an Apple T2 Security Chip fails to start up after a power outage during a macOS update. The technician decides to use a second Mac and Apple Configurator to resolve the issue without erasing user data. What is the appropriate action to take?

Restore the Mac's firmware, which erases all data.
Revive the Mac's firmware. (Correct answer)
Boot the Mac in Target Disk Mode to repair the disk.
Reinstall macOS from Internet Recovery.

Correct answer: Revive the Mac's firmware.

A 'revive' operation updates the firmware and recoveryOS without making changes to the startup volume or user data, making it the ideal first step for firmware-related startup issues on T2 and Apple silicon Macs. A 'restore' erases the internal storage completely. Internet Recovery might not be possible if the firmware is corrupted, and Target Disk Mode doesn't address firmware issues.

Question 83: A user has forgotten their login password on a Mac where FileVault is enabled. They do not have their recovery key, but they did associate their Apple ID with the account for password reset purposes. What is the expected procedure for them to regain access?

They should contact Apple Support with the device's serial number to get a master password.
They need to boot into Single User Mode to run the 'resetpassword' command.
They must erase the Mac and restore from a backup.
After three incorrect password attempts, an option will appear to reset the password using their Apple ID. (Correct answer)

Correct answer: After three incorrect password attempts, an option will appear to reset the password using their Apple ID.

When FileVault is enabled and the user has allowed their Apple ID/iCloud account to unlock the disk, macOS will present an option to reset the password using the Apple ID after several failed login attempts. This provides a secure way to regain access without the recovery key or needing to erase the device.

Question 84: Which macOS security technology is primarily responsible for ensuring that an app downloaded from outside the Mac App Store has been checked by Apple for known malicious content and has not been altered?

XProtect
Gatekeeper (Correct answer)
App Sandbox
FileVault

Correct answer: Gatekeeper

Gatekeeper is the macOS security feature designed to ensure that only trusted software runs on a Mac. When a user opens an app downloaded from outside the App Store, Gatekeeper verifies that it's from an identified developer and has been notarized by Apple, which is a process that scans for malicious content. App Sandbox contains apps to limit potential damage, FileVault encrypts the disk, and XProtect is the anti-malware technology that Gatekeeper uses, but Gatekeeper is the overarching system that performs the check at launch time.

Question 85: Which two items in the System Information sidebar below Software allow you to verify that a Mac is enrolled by an MDM solution?

Extensions and Logs
Profiles and Sync Services
Installations and Managed Client
Managed Client and Profiles (Correct answer)

Correct answer: Managed Client and Profiles

Explanation: You can view the Managed Client and Profiles system reports to verify that a Mac is enrolled by an MDM solution. Continue to study resources related to the following learning objective: Locate a configuration profile on a managed Mac in System Information.

Question 86: What is 'loginwindow' in macOS and what role does it play in the login process?

loginwindow is a Launch Daemon that manages network authentication before the login screen appears
loginwindow is an Apple app available in the App Store for customizing the login screen appearance
loginwindow is a configuration file that defines the appearance of the macOS login screen for enterprise deployments
loginwindow is the macOS process that manages the login screen, authenticates users, launches the user session (Dock, Finder, login items), and handles logout/shutdown sequences (Correct answer)

Correct answer: loginwindow is the macOS process that manages the login screen, authenticates users, launches the user session (Dock, Finder, login items), and handles logout/shutdown sequences

loginwindow is the core macOS process (PID typically low number, runs as root) that displays the login window, authenticates credentials via Directory Services, sets up the user environment, launches Dock and Finder, processes login items, and manages the entire session lifecycle.

Question 87: A user enables the macOS Application Firewall in its default configuration. An unsigned application attempts to accept an incoming network connection for the first time. What is the expected behavior?

The connection is silently blocked.
The firewall automatically adds a permanent "allow" rule for the application.
The connection is automatically allowed.
A dialog box appears asking the user to allow or deny the connection. (Correct answer)

Correct answer: A dialog box appears asking the user to allow or deny the connection.

By default, the macOS Application Firewall is configured to allow connections for signed software automatically. However, when an unsigned application attempts to receive an incoming connection, Gatekeeper and the firewall work together to prompt the user to explicitly allow or deny the connection, giving the user control over untrusted software.

Question 88: After installing a new kernel extension, a Mac immediately kernel panics on every boot. What is the fastest way to recover without reinstalling macOS?

Boot from Recovery and run First Aid on the startup volume
Reinstall macOS over the existing installation
Reset NVRAM and restart normally
Boot into Safe Mode to prevent the extension from loading, then remove it (Correct answer)

Correct answer: Boot into Safe Mode to prevent the extension from loading, then remove it

Safe Mode skips non-essential kernel extensions, allowing you to boot successfully and remove the problematic extension before returning to a normal startup.

Question 89: A technician is troubleshooting why an APFS volume's FileVault recovery key cannot be used. The user insists the key was saved during setup. What is a common reason the personal recovery key fails?

Personal recovery keys expire after 30 days
The key was generated for a different volume or a prior FileVault enablement (Correct answer)
FileVault recovery keys require Touch ID to activate
Recovery keys only work on Intel Macs, not Apple silicon

Correct answer: The key was generated for a different volume or a prior FileVault enablement

If FileVault was turned off and re-enabled, a new recovery key is generated; any previously saved key is no longer valid for the current encryption state.

Question 90: What is the purpose of the 'defaults' command in macOS Terminal?

Reset all system settings to factory defaults
Read and write macOS application preference values stored in .plist files (Correct answer)
Set system default applications for file types
Configure default shell settings for new user accounts

Correct answer: Read and write macOS application preference values stored in .plist files

The 'defaults' command reads and writes macOS application preferences stored in property list (.plist) files in ~/Library/Preferences/, allowing technicians to configure app and system settings from the command line.

Question 91: In macOS Network settings, what is the purpose of configuring a 'Search Domain'?

It forces all DNS queries through the specified domain's nameservers
It appends the domain to short hostnames so they resolve correctly on a local network (Correct answer)
It restricts browsing to only that domain for parental controls
It sets the default homepage in Safari to that domain

Correct answer: It appends the domain to short hostnames so they resolve correctly on a local network

A search domain causes macOS to append the domain suffix to unqualified hostnames (e.g., 'server' becomes 'server.company.local') enabling local name resolution.

Question 92: A user reports that an app purchased from the Mac App Store shows 'App Not Available' and cannot be re-downloaded. What is the most likely cause?

The user's Apple ID does not have purchase history for that app
The app requires a newer macOS version than installed
The App Store cache files are corrupt
The app was removed from the App Store by the developer (Correct answer)

Correct answer: The app was removed from the App Store by the developer

When an app is removed from the Mac App Store by its developer or Apple, existing owners can no longer re-download it, even if they purchased it, as App Store distribution is tied to current availability.

Question 93: A user sees 'Security Policy' options in macOS Recovery on their Apple Silicon Mac. What does setting it to 'Reduced Security' allow?

Loading third-party kernel extensions (kexts) that are not notarized by Apple (Correct answer)
Disabling FileVault encryption permanently
Running macOS without a user password
Installing macOS from a non-Apple server

Correct answer: Loading third-party kernel extensions (kexts) that are not notarized by Apple

Reduced Security allows the Mac to load legacy or third-party kernel extensions that haven't passed Apple's notarization process.

Question 94: What diagnostic information can a technician find in the macOS Console app when troubleshooting startup issues?

Console logs are encrypted and can only be decoded by Apple Authorized Service Providers
Console requires Apple Developer Tools to be installed before it can display startup log messages
Console only shows user-visible error dialogs and notifications, not system-level log messages
Console shows unified system log messages from all processes — filter by 'kernel', 'launchd', or process name to find errors occurring during startup sequence (Correct answer)

Correct answer: Console shows unified system log messages from all processes — filter by 'kernel', 'launchd', or process name to find errors occurring during startup sequence

The Console app (Applications/Utilities) provides access to the unified logging system, showing messages from all macOS processes including kernel, launchd, and all daemons. Filtering by time range and process name reveals what happened during the problematic startup.

Question 95: A user reports that their external SSD is not appearing in Finder but shows up in Disk Utility. What is the most likely cause?

The drive has no partition scheme recognized by macOS
The volume is not mounted (Correct answer)
The drive is formatted as ExFAT
The drive lacks a valid GUID Partition Table

Correct answer: The volume is not mounted

When a drive appears in Disk Utility but not Finder, it typically means the volume exists but is unmounted and needs to be mounted manually.

Question 96: Which of the following is a primary function of the Content Caching service in macOS?

To block incoming connections from unauthorized applications.
To reduce internet data usage by storing local copies of Apple software updates. (Correct answer)
To create a shared network volume for collaborative document editing.
To serve as a Time Machine backup destination for network clients.

Correct answer: To reduce internet data usage by storing local copies of Apple software updates.

The core purpose of the Content Caching service is to download and store local copies of content that devices on the network request from Apple, such as macOS updates, App Store apps, and iCloud data. This significantly reduces internet bandwidth consumption and accelerates download times for other devices on the same network.

Question 97: Which macOS command-line tool can be used to display detailed information about disk partitions and their GUIDs?

gpt show
lsblk
diskutil list (Correct answer)
fdisk -l

Correct answer: diskutil list

The `diskutil list` command displays all disks and partitions including their types, sizes, and identifiers on macOS.

Question 98: How do you view log messages — as they appear — in Console?

In the sidebar select the device whose log messages you want to view, then click Info.
In the sidebar select the device whose log messages you want to view, then click “Start streaming.” (Correct answer)
In the sidebar select Log Reports, click the log message, then choose View > Expand Selected Row.
In the sidebar select system log, click the log message, then choose View > Expand Selected Row.

Correct answer: In the sidebar select the device whose log messages you want to view, then click “Start streaming.”

Explanation: Use this method to view log messages in Console. Continue to study resources related to the following learning objective: Locate error, hang, and crash messages in Console to help identify issues on a Mac.

Question 99: Which file system check tool should be run against an APFS volume when 'fsck' is needed from macOS Recovery?

fsck_apfs (Correct answer)
diskutil verify
fsck_hfs
apfs_util -check

Correct answer: fsck_apfs

The `fsck_apfs` command is the file system consistency check tool specifically designed for APFS volumes on macOS.

Question 100: Which Apple technology allows APFS volumes to take near-instant snapshots of the entire volume state?

Time Machine Local Snapshots
APFS Clones
HFS+ Journal
APFS Snapshots (Correct answer)

Correct answer: APFS Snapshots

APFS (Apple File System) natively supports snapshots — point-in-time copies of a volume's state that are created nearly instantly and consume minimal additional space by using copy-on-write technology.

Apple Certified Support Professional (ACSP)

The ACSP certification validates the ability to support macOS users, troubleshoot issues, configure key services, and manage Apple devices in professional environments.

100

Questions

120 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds