ACMT Storage & Memory 2 — Questions and Answers
Question 1: Which command in macOS Terminal displays information about all APFS volumes and their container structure?
- df -h
- diskutil apfs list (Correct answer)
- ls /Volumes
- mount -t apfs
Correct answer: diskutil apfs list
'diskutil apfs list' shows all APFS containers, their volumes, sizes, roles, and capacities, essential for diagnosing complex APFS configurations.
Question 2: What is a 'Time Machine local snapshot' in APFS?
- A cloud backup to iCloud
- An APFS snapshot stored on the local disk allowing recovery of deleted files even without a backup drive connected (Correct answer)
- A full disk clone saved to an external drive
- A macOS Recovery partition
Correct answer: An APFS snapshot stored on the local disk allowing recovery of deleted files even without a backup drive connected
Time Machine creates APFS local snapshots on the startup drive that allow file recovery even when the backup drive is not connected, leveraging APFS's native snapshot capability.
Question 3: A technician notices a Mac's SSD shows 'Verified' in Disk Utility but SMART status shows 'Failing.' What should they do?
- Ignore the SMART status and run First Aid
- Immediately back up the customer's data and replace the SSD (Correct answer)
- Reset NVRAM
- Reinstall macOS
Correct answer: Immediately back up the customer's data and replace the SSD
A SMART 'Failing' status indicates the drive is predicting its own imminent failure; backing up data immediately and replacing the SSD is the correct response.
Question 4: Which macOS feature encrypts the entire startup volume and requires a recovery key or Apple ID to access it?
- Gatekeeper
- FileVault (Correct answer)
- Secure Enclave
- System Integrity Protection
Correct answer: FileVault
FileVault uses XTS-AES-128 encryption to encrypt the full startup volume, requiring a password and recovery key to access the data.
Question 5: During a Mac repair, a technician needs to access files on an encrypted FileVault drive. The customer cannot remember their password. What is the procedure?
- Use Target Disk Mode to access the drive directly
- Use the FileVault recovery key associated with the customer's Apple ID to unlock the drive (Correct answer)
- Erase the drive and reinstall macOS
- Run fsck to bypass encryption
Correct answer: Use the FileVault recovery key associated with the customer's Apple ID to unlock the drive
The FileVault recovery key, stored by the user or in escrow with Apple, is the only legitimate way to unlock a FileVault-encrypted drive when the password is forgotten.
Question 6: What does the 'Storage' tab in Activity Monitor reveal that is useful for diagnosing performance issues?
- GPU memory usage
- Disk read/write activity per process, helping identify processes causing high disk I/O (Correct answer)
- Available RAM
- Network throughput
Correct answer: Disk read/write activity per process, helping identify processes causing high disk I/O
The Disk tab in Activity Monitor shows per-process disk read and write rates, helping identify processes causing excessive disk I/O that may degrade performance.
ACMT Storage & Memory 2
Which command in macOS Terminal displays information about all APFS volumes and their container structure?