Apple Certified Support Professional (ACSP) — Questions and Answers

Question 1: A user's Mac goes to sleep too quickly while running a presentation. Which Energy Saver (or Battery) setting should be adjusted?

Prevent computer from sleeping automatically when the display is off
Enable Power Nap
Turn display off after (Correct answer)
Wake for network access

Correct answer: Turn display off after

The 'Turn display off after' slider controls how long the display stays on before sleeping; setting it to 'Never' prevents sleep during a presentation.

Question 2: What does 'Revive' do in Apple Configurator 2 for Apple silicon Macs?

Unlocks a supervised device for personal use by removing MDM enrollment
Restores the Mac from a backup file created in Apple Configurator 2
Updates the firmware and recoveryOS on an Apple silicon Mac without erasing user data (Correct answer)
Completely erases and reinstalls macOS, wiping all user data in the process

Correct answer: Updates the firmware and recoveryOS on an Apple silicon Mac without erasing user data

'Revive' in Apple Configurator 2 reinstalls firmware and recoveryOS on an Apple silicon Mac, fixing firmware corruption while preserving the macOS installation and all user data on the Mac.

Question 3: What does the 'tmutil' command-line tool allow a technician to do that the Time Machine GUI does not?

Start/stop backups, list snapshots, delete specific backups, and get detailed backup status information (Correct answer)
Configure Time Machine to back up to cloud storage services
Remotely manage Time Machine backups on other Macs on the network
Repair corrupt Time Machine backup databases

Correct answer: Start/stop backups, list snapshots, delete specific backups, and get detailed backup status information

'tmutil' is the command-line interface for Time Machine that exposes advanced capabilities including scripted backup control, snapshot management, backup deletion, inheritance, and detailed status/log output.

Question 4: What is the primary advantage of having multiple APFS volumes within a single container, as opposed to traditional partitioning?

Each volume can have a different file system format (e.g., APFS, HFS+).
Volumes can be individually encrypted with different passwords.
It provides hardware-level RAID redundancy for all volumes.
All volumes within the container share the free space of that container. (Correct answer)

Correct answer: All volumes within the container share the free space of that container.

A key feature of Apple File System (APFS) is space sharing. Multiple volumes within a single APFS container share the total available space in that container, allocating it on demand. This is more flexible than traditional partitions, where each partition has a fixed size. While volumes can be encrypted, they all reside in the same container, and you cannot mix file system formats like APFS and HFS+ within the same APFS container.

Question 5: A technician is using Disk Utility to troubleshoot a storage issue. They need to check for and repair errors in the file system structure of a volume. Which Disk Utility feature should they use?

Restore
Erase
Partition
First Aid (Correct answer)

Correct answer: First Aid

First Aid is the feature in Disk Utility designed to check a disk for errors and make repairs if necessary. It verifies and repairs the file system structure and permissions. Erase is for formatting a volume, Partition is for creating or modifying partitions, and Restore is for copying a volume from a source to a destination.

Question 6: What is the purpose of a Certificate Authority (CA) certificate and why would a company need to install one on managed Macs?

A CA certificate is an Apple-issued document that proves the Mac is enrolled in Apple Business Manager
A CA certificate replaces the need for a VPN by encrypting web traffic at the browser level
A CA certificate is required to unlock the Mac App Store for enterprise app distribution
A CA certificate establishes trust in the company's own certificate infrastructure, allowing Macs to trust internal HTTPS sites, VPNs, and network authentication without security warnings (Correct answer)

Correct answer: A CA certificate establishes trust in the company's own certificate infrastructure, allowing Macs to trust internal HTTPS sites, VPNs, and network authentication without security warnings

A root CA certificate, when installed on managed Macs, makes macOS trust all certificates signed by that CA. Companies install their internal CA to enable trusted HTTPS for internal web apps, WPA2-Enterprise Wi-Fi authentication, and VPN certificate authentication without browser warnings.

Question 7: Which macOS utility command verifies and repairs permissions on a volume running macOS Catalina or later?

sudo repair_packages --verify --standard-pkgs /
diskutil repairPermissions /
diskutil repairVolume / (Correct answer)
fsck_apfs -y /dev/disk1s1

Correct answer: diskutil repairVolume /

On macOS Catalina and later, `diskutil repairVolume` is used since System Integrity Protection manages system file permissions automatically.

Question 8: What does piping (|) do in macOS Terminal commands?

Runs two commands simultaneously in parallel
Separates two independent commands to run sequentially
Saves the output of a command to a file
Sends the standard output of one command as the standard input to the next command (Correct answer)

Correct answer: Sends the standard output of one command as the standard input to the next command

The pipe character (|) connects commands in a chain, passing the standard output (stdout) of the command on the left as the standard input (stdin) of the command on the right, enabling powerful command combinations.

Question 9: What is 'Focus' in macOS and iOS and how can it be used in a business context?

Focus mode locks the device screen and prevents any notifications until a Face ID or Touch ID unlock
Focus is a macOS feature that boosts CPU and memory performance by disabling background tasks
Focus allows users to filter notifications and app access based on time, location, or activity (Work, Personal, Sleep); organizations can configure Allowed Apps and Contacts in MDM-managed Focus modes (Correct answer)
Focus is exclusively a Do Not Disturb upgrade and cannot restrict app access or be customized beyond notification filtering

Correct answer: Focus allows users to filter notifications and app access based on time, location, or activity (Work, Personal, Sleep); organizations can configure Allowed Apps and Contacts in MDM-managed Focus modes

Focus (macOS Monterey+, iOS 15+) creates customized modes filtering which apps and contacts can send notifications. It can be scheduled, location-triggered, or activity-based. Focus status can be shared with contacts, and MDM can configure and manage Focus modes on supervised devices.

Question 10: A system administrator needs to gain secure command-line access to a remote Mac server to run maintenance scripts. Which service must be enabled in the Sharing settings to allow this type of connection?

Remote Management
Remote Login (Correct answer)
Screen Sharing
File Sharing

Correct answer: Remote Login

The 'Remote Login' service in Sharing settings enables the SSH (Secure Shell) daemon. SSH provides an encrypted, secure channel for command-line access over a network, which is the standard method for remote administration via Terminal.

Question 11: What is two-factor authentication (2FA) for Apple ID and how does it affect Mac login and Apple services?

Apple ID 2FA replaces the Apple ID password entirely with a device-based authentication code
Apple ID 2FA requires a trusted device or phone number to receive a 6-digit code in addition to the password; required for iCloud features on macOS and strongly recommended for all Apple accounts (Correct answer)
Apple ID 2FA is only required for enterprise accounts managed through Apple Business Manager
2FA for Apple ID only affects App Store purchases and does not impact macOS login or iCloud sync

Correct answer: Apple ID 2FA requires a trusted device or phone number to receive a 6-digit code in addition to the password; required for iCloud features on macOS and strongly recommended for all Apple accounts

Apple ID two-factor authentication requires both the password and a 6-digit verification code sent to a trusted Apple device or phone number. It's enforced for certain features (iCloud Keychain, Find My, etc.) and provides crucial account security against password-only attacks.

Question 12: How does macOS handle Managed Open In to prevent data leakage between managed and unmanaged apps?

Managed Open In prevents any file from being opened in more than one application on a managed device
Managed Open In is a macOS Ventura feature that replaces the older App Sandbox for MDM-managed apps
Managed Open In is an MDM restriction that prevents all file sharing between apps regardless of management status
Managed Open In (Open From/Open In restrictions) prevents managed app data from being opened in unmanaged apps and vice versa, enforced via MDM policy to separate corporate and personal data (Correct answer)

Correct answer: Managed Open In (Open From/Open In restrictions) prevents managed app data from being opened in unmanaged apps and vice versa, enforced via MDM policy to separate corporate and personal data

Managed Open In (a corporate data separation feature set via MDM) controls the flow of documents between managed and unmanaged apps — documents from managed sources (corporate email, managed apps) cannot be opened in personal/unmanaged apps, preventing accidental corporate data leakage.

Question 13: A user reports that an app purchased from the Mac App Store shows 'App Not Available' and cannot be re-downloaded. What is the most likely cause?

The app requires a newer macOS version than installed
The app was removed from the App Store by the developer (Correct answer)
The user's Apple ID does not have purchase history for that app
The App Store cache files are corrupt

Correct answer: The app was removed from the App Store by the developer

When an app is removed from the Mac App Store by its developer or Apple, existing owners can no longer re-download it, even if they purchased it, as App Store distribution is tied to current availability.

Question 14: What is Target Disk Mode and which connection types support it?

Target Disk Mode boots a Mac from another Mac's operating system over the network
Target Disk Mode allows two Macs to share a single display and keyboard
Target Disk Mode makes a Mac appear as an external drive to another Mac; supported over Thunderbolt and USB-C on Intel Macs, and replaced by Share Disk on Apple silicon via Thunderbolt (Correct answer)
Target Disk Mode enables a Mac to use another Mac's RAM and CPU for performance tasks

Correct answer: Target Disk Mode makes a Mac appear as an external drive to another Mac; supported over Thunderbolt and USB-C on Intel Macs, and replaced by Share Disk on Apple silicon via Thunderbolt

Target Disk Mode (Intel Macs) makes a Mac act as an external drive when connected via Thunderbolt, USB-C, or FireWire. Apple silicon Macs use 'Share Disk' in macOS Recovery instead, accessible over Thunderbolt/USB-C connections.

Question 15: A support professional needs to generate a comprehensive report of a Mac's hardware, including details about memory, PCI cards, and attached USB devices, directly from the command line. Which utility is the command-line equivalent of the System Information app?

sysctl -a
system_profiler (Correct answer)
hwinfo --all
uname -m

Correct answer: system_profiler

The `system_profiler` command is the command-line interface to the same information framework used by the graphical System Information application. It can be used to generate detailed reports on numerous hardware and software data types.

Question 16: What is the purpose of the 'Signed System Volume' (SSV) in Apple silicon and T2 Macs?

It prevents the system volume from being read by unauthorized external tools or boot disks
It cryptographically seals the macOS system files so any unauthorized modification is detected at boot and the system refuses to start (Correct answer)
It encrypts user home folders with keys derived from the system hardware
It signs all user-installed applications with the system's private key to verify their authenticity

Correct answer: It cryptographically seals the macOS system files so any unauthorized modification is detected at boot and the system refuses to start

The Signed System Volume (SSV) creates a cryptographic hash tree (Merkle tree) of all macOS system files. At boot, the kernel verifies this seal — if any system file has been modified or tampered with, the Mac detects the mismatch and refuses to boot from that volume.

Question 17: How do you reset the SMC on an Intel Mac with a non-removable battery?

Boot into Recovery Mode and select Reset SMC
Press Shift+Control+Option+Power simultaneously for 10 seconds while plugged in (Correct answer)
Hold the power button for 10 seconds
Remove and reconnect the AC adapter three times

Correct answer: Press Shift+Control+Option+Power simultaneously for 10 seconds while plugged in

On Intel Macs with built-in batteries, the SMC reset involves pressing Shift+Control+Option along with the power button for 10 seconds while connected to AC power.

Question 18: A technician troubleshooting a Mac that fails to boot suspects that a custom 'boot-args' value is causing the problem. Which command-line utility, available in the macOS Recovery environment, is used to view and modify these firmware variables?

diskutil
fdesetup
csrutil
nvram (Correct answer)

Correct answer: nvram

The `nvram` command is used to get or set firmware variables stored in the Mac's Non-Volatile RAM. Boot arguments, which can alter the startup process, are stored in the 'boot-args' variable and can be viewed or cleared using this utility, often from the Terminal in macOS Recovery.

Question 19: Which command shows the network routing table on macOS?

ifconfig -r
route -list
netstat -rn (Correct answer)
networksetup --routes

Correct answer: netstat -rn

`netstat -rn` displays the kernel routing table in numeric form without DNS resolution.

Question 20: A technician needs to enroll a fleet of company-owned iPhones automatically into MDM without touching each device. Which Apple program enables this?

TestFlight MDM Profile
Apple Configurator 2 Blueprints
Apple Business Manager with Automated Device Enrollment (Correct answer)
Apple School Manager manual enrollment

Correct answer: Apple Business Manager with Automated Device Enrollment

Apple Business Manager's Automated Device Enrollment (formerly DEP) links purchased devices to an MDM server so they enroll automatically on first setup.

Question 21: When using an Apple Studio Display connected to a MacBook Pro, a user reports the display's built-in camera is not recognized. What should you check first?

Whether the user has enabled Screen Time restrictions
If the display's USB-C cable is fully seated in the Thunderbolt port (Correct answer)
Camera permissions in System Settings > Privacy & Security
Whether Thunderbolt firmware is up to date on the display

Correct answer: If the display's USB-C cable is fully seated in the Thunderbolt port

The Studio Display's camera, speaker, and microphone only function when connected via the included Thunderbolt cable that also carries data; a loose connection drops those devices.

Question 22: A user reports that after resetting their Mac with Apple silicon, they cannot log in with their existing Apple ID. What is the most likely cause?

Apple ID login is disabled until MDM enrollment completes
The user must create a local account before linking an Apple ID
Apple IDs are not supported on Apple silicon Macs
The Mac requires an Activation Lock bypass code from Apple Business Manager (Correct answer)

Correct answer: The Mac requires an Activation Lock bypass code from Apple Business Manager

If a Mac is enrolled in Apple Business Manager or School Manager, Activation Lock prevents login until a bypass code is used or the device is released from MDM.

Question 23: Which command-line tool in macOS can be used to list available printers and their status from the Terminal?

lpstat -p (Correct answer)
system_profiler SPPrintersDataType only
printutil
lsusb --printers

Correct answer: lpstat -p

`lpstat -p` lists all configured printers and indicates whether each is enabled or disabled.

Question 24: What command-line tool reads and writes macOS user defaults stored as .plist files?

systemsetup
defaults (Correct answer)
plutil
nvram

Correct answer: defaults

The `defaults` command allows reading, writing, and deleting macOS preference values stored in .plist files under ~/Library/Preferences/ and /Library/Preferences/.

Question 25: What happens when you hold Option while clicking 'Force Quit' for an application in macOS?

The Relaunch button appears, allowing the app to be immediately restarted after force-quitting (Correct answer)
The app is suspended rather than terminated
The app is force-quit and its preference file is automatically deleted
A kernel panic report is generated for the crashed app

Correct answer: The Relaunch button appears, allowing the app to be immediately restarted after force-quitting

Holding Option while selecting Force Quit in the Force Quit Applications window changes the button to 'Relaunch,' which force-quits the app and immediately relaunches it — useful for frozen apps you still need to use.

Question 26: A technician needs to remove a stubborn network location profile from a Mac managed by MDM. Where should they look first?

Network preferences > Locations menu
Keychain Access > System keychain
System Settings > VPN
Profiles section in System Settings (Correct answer)

Correct answer: Profiles section in System Settings

MDM-deployed network profiles appear in System Settings > Privacy & Security > Profiles (or General > Device Management), where they can be reviewed and removed if authorized.

Question 27: Which macOS utility can be used to create a bootable installer on a USB drive from the command line?

bless
createinstallmedia (Correct answer)
hdiutil
diskutil

Correct answer: createinstallmedia

The `createinstallmedia` command, bundled inside the macOS installer app, is the Apple-supported way to create a bootable USB installer.

Question 28: What are 'login items' in macOS and where are the different types stored?

Login items only include apps added by the user; system services use a separate startup mechanism unavailable to users
Login items launch apps/processes when a user logs in; types include user login items (System Settings > General > Login Items), LaunchAgents (~/Library/LaunchAgents and /Library/LaunchAgents), and Legacy Login Items (SMLoginItemSetEnabled) (Correct answer)
Login items and Launch Daemons are identical — both start at user login in the same sequence
Login items are exclusively managed via System Settings > Users & Groups and cannot be modified from the command line

Correct answer: Login items launch apps/processes when a user logs in; types include user login items (System Settings > General > Login Items), LaunchAgents (~/Library/LaunchAgents and /Library/LaunchAgents), and Legacy Login Items (SMLoginItemSetEnabled)

Login items encompass multiple mechanisms: User-facing login items in System Settings > General > Login Items, LaunchAgents in ~/Library/LaunchAgents/ (per-user) and /Library/LaunchAgents/ (all users), plus background items registered via SMLoginItemSetEnabled by app installers.

Question 29: What is iCloud Drive's 'Optimize Mac Storage' feature and what risk does it introduce?

It removes local copies of older iCloud files to free disk space, but files are unavailable without internet (Correct answer)
It moves files to external storage while keeping shortcuts locally
It automatically deletes duplicate files found in iCloud Drive
It compresses all local files to reduce disk usage while keeping them accessible offline

Correct answer: It removes local copies of older iCloud files to free disk space, but files are unavailable without internet

Optimize Mac Storage removes local copies of older or less-used iCloud Drive files when disk space is low, keeping only the file stub (cloud icon) locally. Files must be re-downloaded from iCloud when accessed, requiring internet connectivity.

Question 30: A user on an Intel-based Mac wants to reinstall the version of macOS that originally came with their computer. Which key combination should they press and hold immediately after turning on or restarting the Mac to start up from macOS Recovery over the internet?

Shift (⇧)
Shift (⇧)-Option (⌥)-Command (⌘)-R (Correct answer)
Command (⌘)-R
Option (⌥)-Command (⌘)-R

Correct answer: Shift (⇧)-Option (⌥)-Command (⌘)-R

To reinstall the version of macOS that came with an Intel-based Mac or the closest version still available, the correct key combination is Shift-Option-Command-R. Command-R reinstalls the latest macOS that was installed. Option-Command-R upgrades to the latest compatible macOS. Shift simply starts up in safe mode.

Question 31: Which macOS security technology is primarily responsible for ensuring that an app downloaded from outside the Mac App Store has been checked by Apple for known malicious content and has not been altered?

App Sandbox
FileVault
XProtect
Gatekeeper (Correct answer)

Correct answer: Gatekeeper

Gatekeeper is the macOS security feature designed to ensure that only trusted software runs on a Mac. When a user opens an app downloaded from outside the App Store, Gatekeeper verifies that it's from an identified developer and has been notarized by Apple, which is a process that scans for malicious content. App Sandbox contains apps to limit potential damage, FileVault encrypts the disk, and XProtect is the anti-malware technology that Gatekeeper uses, but Gatekeeper is the overarching system that performs the check at launch time.

Question 32: When using Safe Mode (Safe Boot) to troubleshoot a Mac startup issue, which of the following does macOS NOT do during a Safe Mode boot?

Delete font caches and some system caches
Back up user data to iCloud automatically (Correct answer)
Load only required kernel extensions
Run a basic check of the startup disk

Correct answer: Back up user data to iCloud automatically

Safe Mode performs disk checks, loads only essential kexts, and clears some caches, but it does not trigger or modify iCloud backups.

Question 33: Which log file should a technician examine first to identify the cause of a recent kernel panic on macOS?

~/Library/Logs/CrashReporter/ for user-space crashes
/private/var/db/diagnostics/ for unified log archives
/Library/Logs/DiagnosticReports/ for .panic files (Correct answer)
/var/log/system.log for the most recent entries

Correct answer: /Library/Logs/DiagnosticReports/ for .panic files

macOS writes a detailed .panic file to /Library/Logs/DiagnosticReports/ after each kernel panic, which contains the backtrace and loaded kexts at the time of the crash.

Question 34: What is Thunderbolt daisy-chaining and how many devices can be connected in a chain?

Thunderbolt supports daisy-chaining of 3 devices maximum; additional devices require a hub or dock
Thunderbolt allows up to 6 devices to be daisy-chained in a series from a single Thunderbolt port, with each device passing the Thunderbolt bus to the next device in the chain (Correct answer)
Thunderbolt daisy-chaining allows unlimited devices but bandwidth is divided equally among all connected devices
Thunderbolt daisy-chaining is not supported on Macs with Apple silicon — only USB hubs are supported

Correct answer: Thunderbolt allows up to 6 devices to be daisy-chained in a series from a single Thunderbolt port, with each device passing the Thunderbolt bus to the next device in the chain

Thunderbolt supports daisy-chaining up to 6 devices per Thunderbolt port (plus the Mac = 7 devices total in the chain). Each device in the chain must have two Thunderbolt ports — one for input and one to pass the bus to the next device.

Question 35: What is the 'ping' command used for in macOS network troubleshooting?

Ping sends ICMP Echo Request packets to a destination and measures round-trip time; used to verify connectivity, test if a host is reachable, and identify latency or packet loss (Correct answer)
Ping establishes a TCP connection to a server to test if a web service is responding
Ping downloads a small test file from a server to measure network throughput and bandwidth
Ping is used to check the status of DNS resolution without testing network connectivity

Correct answer: Ping sends ICMP Echo Request packets to a destination and measures round-trip time; used to verify connectivity, test if a host is reachable, and identify latency or packet loss

'ping hostname' or 'ping IP_address' sends ICMP Echo Requests and reports replies with round-trip times. No replies = host unreachable or blocking ICMP. High latency or packet loss indicates network issues. Essential first-step connectivity test.

Question 36: An IT administrator needs to test whether TCP port 443 is open on a remote server from a Mac. Which command is most appropriate?

nc -zv server.example.com 443 (Correct answer)
ping -p 443 server.example.com
nslookup server.example.com 443
traceroute server.example.com 443

Correct answer: nc -zv server.example.com 443

The netcat (nc) command with -zv flags performs a port scan verbosely without sending data, confirming whether TCP port 443 is open.

Question 37: Which macOS Recovery environment installs the same macOS version that came with the Mac when purchased?

Booting from a USB installer
Shift+Option+Command+R at startup (Intel) (Correct answer)
Option+Command+R at startup (Intel)
Command+R at startup

Correct answer: Shift+Option+Command+R at startup (Intel)

On Intel Macs, Shift+Option+Command+R at startup triggers recovery that installs the original macOS the Mac shipped with, or the earliest compatible version.

Question 38: What does `diskutil list` display in macOS Terminal?

Free and used disk space for each volume
SMART status for all connected drives
Mounted network shares and local volumes
All attached disks and their partitions with identifiers (Correct answer)

Correct answer: All attached disks and their partitions with identifiers

`diskutil list` enumerates all disks and their partition schemes, sizes, and BSD device identifiers.

Question 39: A customer's MacBook Air won't boot past the Apple logo. Apple Diagnostics shows no hardware errors. Which tool should the technician use next to check for SSD integrity issues?

Network Utility
System Information app
Activity Monitor
Disk Utility's First Aid in Recovery Mode (Correct answer)

Correct answer: Disk Utility's First Aid in Recovery Mode

Running Disk Utility's First Aid in Recovery Mode checks and repairs file system errors that can prevent macOS from completing startup.

Question 40: What is the purpose of DNS (Domain Name System) in macOS network configuration?

DNS assigns IP addresses to devices on the local network dynamically
DNS encrypts network traffic between the Mac and internet servers for security
DNS translates human-readable domain names (like apple.com) into numeric IP addresses that computers use to communicate (Correct answer)
DNS monitors network traffic and blocks access to malicious websites

Correct answer: DNS translates human-readable domain names (like apple.com) into numeric IP addresses that computers use to communicate

DNS resolves domain names to IP addresses. When a Mac connects to apple.com, it first queries a DNS server to get the IP address (e.g., 17.253.144.10), then connects to that IP. Without DNS, users would need to memorize numeric IP addresses.

Question 41: A support professional is analyzing system performance in Activity Monitor and wants to understand the relationship between different processes. They suspect a helper tool is being launched by a main application. How can they change the view in Activity Monitor to see these parent-child process relationships?

Select 'Windowed Processes' from the View menu.
Click the 'Memory' tab to see process memory allocation.
Double-click on a process to open the 'Inspect' window.
Select 'All Processes, Hierarchically' from the View menu. (Correct answer)

Correct answer: Select 'All Processes, Hierarchically' from the View menu.

The 'All Processes, Hierarchically' view in Activity Monitor is specifically designed to show the parent-child relationships between processes. This allows an administrator to see which processes were launched by others, which is useful for troubleshooting. The other options provide different types of information but do not display this hierarchical structure.

Question 42: What is kernel panic on macOS and what information should a technician collect when diagnosing it?

Kernel panic is a fatal system error where the macOS kernel cannot recover; technicians should collect panic logs from /Library/Logs/DiagnosticReports/ and the crash reporter info shown at restart (Correct answer)
Kernel panic logs are stored in the Time Machine backup only and cannot be accessed from the live system
Kernel panic is the same as a spinning beachball (wait cursor) and indicates an app has hung
Kernel panic only occurs on Apple silicon Macs and is resolved by resetting the SMC

Correct answer: Kernel panic is a fatal system error where the macOS kernel cannot recover; technicians should collect panic logs from /Library/Logs/DiagnosticReports/ and the crash reporter info shown at restart

Kernel panic is an unrecoverable kernel crash causing immediate system restart. Panic logs are saved to /Library/Logs/DiagnosticReports/ with .panic extension and contain stack traces, loaded KEXTs, and memory state at time of crash — critical for diagnosing the cause.

Question 43: A Mac user reports that Spotlight search is returning outdated or incomplete results. What is the recommended fix?

Disable and re-enable FileVault
Reinstall macOS to rebuild the search database
Re-index Spotlight by removing and re-adding the startup disk in Spotlight Privacy settings (Correct answer)
Delete the user's Library folder

Correct answer: Re-index Spotlight by removing and re-adding the startup disk in Spotlight Privacy settings

Removing and re-adding the disk in Spotlight > Privacy forces a complete Spotlight index rebuild, resolving stale or missing search results.

Question 44: You’re troubleshooting Anthony’s managed Mac, and the next step is to start in safe mode. You’re asked to authenticate. What should you use to authenticate?

The organization-linked Activation Lock bypass code
The firmware password
The user-linked Activation Lock bypass code
The recoveryOS password set from MDM (Correct answer)

Correct answer: The recoveryOS password set from MDM

Explanation: When you start Anthony’s managed Mac in safe mode, you authenticate using the recoveryOS password set by MDM. Continue to study resources related to the following learning objective: Recognize and use the appropriate boot modes for a Mac with Apple silicon.

Question 45: An iPhone is stuck in a reboot loop and does not respond to a normal restart. Which action should a support professional recommend first?

Connect to iTunes and perform a DFU restore immediately
Boot into Recovery Mode and erase the device
Remove and reinsert the SIM card
Force restart using the correct button combination for the iPhone model (Correct answer)

Correct answer: Force restart using the correct button combination for the iPhone model

A force restart (model-specific button sequence) is the least destructive first step and often breaks a boot loop without data loss.

Question 46: What is Automated Device Enrollment (ADE) supervision and what additional management capabilities does it enable on Macs?

ADE supervision locks the MDM enrollment profile so users cannot remove it, and enables capabilities like Always On VPN, content filtering, and restrictions on System Settings changes (Correct answer)
ADE supervision is the same as FileVault — it adds a supervision password that protects the encrypted volume
ADE supervision enables Apple to remotely manage Macs directly without a third-party MDM server
ADE supervision requires a physical Apple Store connection to activate and verify each device

Correct answer: ADE supervision locks the MDM enrollment profile so users cannot remove it, and enables capabilities like Always On VPN, content filtering, and restrictions on System Settings changes

ADE-supervised Macs cannot have their MDM enrollment profile removed by the user, and MDM gains access to supervision-only features: enforcing Always On VPN, blocking System Settings sections, deploying System Extensions without user approval, and preventing the Mac from being wiped without MDM authorization.

Question 47: Which macOS feature creates an encrypted tunnel between a Mac and a private network, and is configurable directly within System Settings without third-party software for IKEv2 connections?

iCloud Private Relay
Personal Hotspot
Network Extension framework
VPN (built-in IKEv2/IPSec client) (Correct answer)

Correct answer: VPN (built-in IKEv2/IPSec client)

macOS includes a built-in VPN client supporting IKEv2, IPSec, and L2TP protocols, configurable in System Settings > VPN without additional software.

Question 48: What does the 'sudo' command do in macOS Terminal?

Permanently elevates the current Terminal session to admin level
Displays a list of commands the current user is allowed to run
Executes the following command with superuser (root) privileges (Correct answer)
Switches the current user account to another user

Correct answer: Executes the following command with superuser (root) privileges

'sudo' (superuser do) runs the immediately following command with root privileges after authenticating with the current user's admin password. The elevated privilege applies only to that single command.

Question 49: A user frequently moves their MacBook between their office, which requires a static IP address and specific DNS servers, and home, which uses DHCP. What is the most efficient method to switch between these network configurations without manual reconfiguration each time?

Create and switch between Network Locations. (Correct answer)
Use the `networksetup` command in Terminal before browsing.
Create a separate user account for each location.
Write a script to change network settings upon startup.

Correct answer: Create and switch between Network Locations.

Network Locations in macOS are designed specifically for this scenario. They allow a user to save entire sets of network interface settings (IP address, DNS, proxies, etc.) and quickly switch between them from the Apple menu or System Settings.

Question 50: Which utility in macOS Recovery can be used to restore an entire Mac from a Time Machine backup?

Terminal with tmutil
Restore from Time Machine Backup (Correct answer)
Migration Assistant
Disk Utility

Correct answer: Restore from Time Machine Backup

macOS Recovery includes a 'Restore from Time Machine Backup' option that allows full system restoration directly from a Time Machine backup.

Question 51: Where does macOS store crash reports generated for third-party apps for the current user?

/Library/Logs/CrashReporter/
~/Library/Logs/DiagnosticReports/ (Correct answer)
/var/log/crashes/
/private/var/db/diagnostics/

Correct answer: ~/Library/Logs/DiagnosticReports/

User-level crash reports and diagnostic data for third-party apps are saved to ~/Library/Logs/DiagnosticReports/ by the ReportCrash agent.

Question 52: How does FileVault on an Apple silicon Mac differ from FileVault on an Intel Mac?

Apple silicon uses software-only encryption; Intel Macs use hardware-accelerated encryption via the T2 chip
Apple silicon Macs require an institutional recovery key; personal recovery keys are not supported
FileVault is optional on Intel Macs but cannot be disabled on Apple silicon Macs
On Apple silicon, FileVault leverages the Secure Enclave for hardware-accelerated encryption tightly integrated with the user's login credentials from first boot (Correct answer)

Correct answer: On Apple silicon, FileVault leverages the Secure Enclave for hardware-accelerated encryption tightly integrated with the user's login credentials from first boot

Apple silicon Macs integrate data protection at the hardware level via the Secure Enclave, making FileVault encryption hardware-accelerated and tied to the user's login credential from the very first login. This is a deeper integration than the software-layer approach used on Intel Macs without a T2 chip.

Question 53: A technician needs to revive a Mac with Apple silicon that won't turn on at all. Which tool and connection are required?

Target Disk Mode with a Thunderbolt cable to another Mac
Apple Remote Desktop over the local network
Apple Configurator 2 connected via USB-C to the appropriate port on the target Mac (Correct answer)
A bootable macOS USB drive connected to any USB port

Correct answer: Apple Configurator 2 connected via USB-C to the appropriate port on the target Mac

Apple Configurator 2 can revive or restore Apple silicon Macs by connecting a USB-C cable from a host Mac to the specific DFU port on the target Mac.

Question 54: What does the Apple Support app allow users to do that helps technicians prepare for a service visit?

Run MRI-level hardware diagnostics remotely
Flash firmware updates directly from the app
Share device diagnostics, view warranty status, and schedule Genius Bar appointments (Correct answer)
Access internal Apple Knowledge Base articles restricted to ASPs

Correct answer: Share device diagnostics, view warranty status, and schedule Genius Bar appointments

The Apple Support app lets customers check warranty status, share diagnostic data with Apple, and schedule service appointments, streamlining the support process.

Question 55: Which file system is used by macOS for the primary system volume on Macs with Apple silicon or T2 chips?

ExFAT
NTFS
HFS+ (Mac OS Extended)
APFS (Apple File System) (Correct answer)

Correct answer: APFS (Apple File System)

APFS (Apple File System) is the default and required file system for the macOS system volume on all modern Macs. It was introduced in macOS 10.13 High Sierra and is optimized for SSD storage with features like cloning, snapshots, and strong encryption.

Question 56: What is the purpose of the macOS 'Reinstall macOS' option in Recovery, and does it erase user data?

It reinstalls macOS system files while preserving all user accounts, applications, and data (Correct answer)
It performs a clean install that erases all data including user files and third-party apps
It downloads a new macOS version regardless of what is currently installed
It reinstalls macOS only if the system files have been verified as corrupt by First Aid

Correct answer: It reinstalls macOS system files while preserving all user accounts, applications, and data

'Reinstall macOS' in Recovery replaces only the macOS system files (the System volume) without erasing user data on the Data volume. User accounts, applications, and files are preserved, making it safe to run when macOS itself is broken.

Question 57: What is a VPN (Virtual Private Network) and what types does macOS natively support?

A VPN creates an encrypted tunnel for network traffic; macOS natively supports IKEv2, IPSec, and L2TP over IPSec VPN protocols (Correct answer)
A VPN monitors and filters all network traffic for security; macOS supports only third-party VPN solutions
A VPN creates a private Wi-Fi hotspot; macOS supports WPA3-Personal and WPA3-Enterprise
A VPN is a local network virtualization technology; macOS supports only Apple's proprietary VPN protocol

Correct answer: A VPN creates an encrypted tunnel for network traffic; macOS natively supports IKEv2, IPSec, and L2TP over IPSec VPN protocols

A VPN encrypts and tunnels network traffic through a private server. macOS natively supports IKEv2, Cisco IPSec, and L2TP over IPSec VPN connections in System Settings > Network > Add VPN Configuration, without requiring third-party client apps.

Question 58: A user's app is listed in Activity Monitor but has been unresponsive for 10 minutes. After using Force Quit, the user asks why the app's data may be lost. What is the correct explanation?

Force Quit corrupts the app's preference file causing data loss
macOS deletes the app container when Force Quit is used
Force Quit sends SIGKILL, which terminates the process immediately without giving it time to save state (Correct answer)
Force Quit requires administrator privileges which bypass file permissions

Correct answer: Force Quit sends SIGKILL, which terminates the process immediately without giving it time to save state

Force Quit sends SIGKILL to the process, which causes immediate termination by the kernel with no opportunity for the app to execute cleanup or save routines.

Question 59: A user's Mac was stolen, but they had iCloud Drive sync enabled. What data recovery options are available?

iCloud Drive files are permanently deleted when a device is erased via Find My
Files synced to iCloud Drive can be accessed from any device or iCloud.com; remote erase via Find My can protect remaining data (Correct answer)
Only Time Machine backups can recover files; iCloud Drive does not retain deleted or remotely erased files
Recovery requires contacting Apple Support with proof of purchase

Correct answer: Files synced to iCloud Drive can be accessed from any device or iCloud.com; remote erase via Find My can protect remaining data

iCloud Drive syncs files to Apple's servers, making them accessible from iCloud.com or other signed-in devices regardless of the stolen Mac's status. Find My's remote erase secures remaining data without affecting iCloud-synced copies.

Question 60: A user reports that their external SSD is not appearing in Finder but shows up in Disk Utility. What is the most likely cause?

The drive lacks a valid GUID Partition Table
The drive is formatted as ExFAT
The volume is not mounted (Correct answer)
The drive has no partition scheme recognized by macOS

Correct answer: The volume is not mounted

When a drive appears in Disk Utility but not Finder, it typically means the volume exists but is unmounted and needs to be mounted manually.

Question 61: A user reports that a specific application becomes unresponsive, showing the spinning beach ball cursor whenever they try to use it. The rest of the system is working normally. Which of the following is the MOST appropriate first step to terminate ONLY the problematic application without affecting other running apps?

Use the `killall` command in Terminal without any arguments.
Press Option-Command-Escape to open the Force Quit Applications window. (Correct answer)
Press and hold the power button until the Mac shuts down.
Open Activity Monitor, select 'All Processes', and quit the 'kernel_task' process.

Correct answer: Press Option-Command-Escape to open the Force Quit Applications window.

Pressing Option-Command-Escape opens the Force Quit Applications window, which allows a user to select and terminate a single, unresponsive application. This is the standard, user-friendly method for handling a single misbehaving app. Holding the power button forces a hard shutdown of the entire system. The `killall` command without a specific process name is not a valid or safe operation, and quitting 'kernel_task' can cause system instability as it's a core system process.

Question 62: What are KEXT (Kernel Extensions) and how has Apple changed their handling in modern macOS?

KEXTs are configuration files that extend macOS kernel settings and are approved via System Preferences
KEXTs were replaced by App Extensions in macOS Big Sur and no longer exist in modern macOS
KEXTs are code modules loaded into the macOS kernel for hardware drivers; Apple deprecated them in favor of DriverKit (user-space drivers) and System Extensions, requiring user approval for any legacy KEXTs (Correct answer)
KEXTs are kernel extensions that Apple automatically approves and loads without user interaction

Correct answer: KEXTs are code modules loaded into the macOS kernel for hardware drivers; Apple deprecated them in favor of DriverKit (user-space drivers) and System Extensions, requiring user approval for any legacy KEXTs

KEXTs (Kernel Extensions) run code in the kernel for hardware drivers and system software. Apple deprecated them in favor of user-space alternatives: DriverKit (for hardware drivers), System Extensions (for network/endpoint security), and EndpointSecurity (for security tools). Loading a legacy KEXT requires explicit user approval in Security & Privacy.

Question 63: In macOS Network settings, what is the purpose of configuring a 'Search Domain'?

It forces all DNS queries through the specified domain's nameservers
It restricts browsing to only that domain for parental controls
It sets the default homepage in Safari to that domain
It appends the domain to short hostnames so they resolve correctly on a local network (Correct answer)

Correct answer: It appends the domain to short hostnames so they resolve correctly on a local network

A search domain causes macOS to append the domain suffix to unqualified hostnames (e.g., 'server' becomes 'server.company.local') enabling local name resolution.

Question 64: Which Terminal command configures macOS system settings such as time zone, remote login, and sleep behavior?

systemsetup (Correct answer)
scutil
defaults
networksetup

Correct answer: systemsetup

The `systemsetup` command allows administrators to configure system-level settings from Terminal, useful for scripting Mac deployments.

Question 65: A user's Mac gets stuck on a spinning globe during startup. What does this indicate?

The Mac's internal SSD has failed and needs replacement
The Mac is attempting to boot from a network server via NetBoot or network startup (Correct answer)
The Bluetooth keyboard is not paired and the Mac is waiting for input
macOS is performing a background update automatically

Correct answer: The Mac is attempting to boot from a network server via NetBoot or network startup

A spinning globe at startup means the Mac is attempting to boot from a network startup source such as NetBoot, NetInstall, or NetRestore.

Question 66: A Mac is configured with a manual IP address but loses network access after another device joins the network. What is the most likely issue?

There is an IP address conflict (Correct answer)
IPv6 is interfering with IPv4
The subnet mask is incorrect
The default gateway has changed

Correct answer: There is an IP address conflict

When a manually configured IP is also assigned by DHCP to another device, an IP conflict causes both machines to lose reliable connectivity.

Question 67: To ensure a critical software update process is not interrupted, an administrator needs to prevent a Mac from sleeping for the duration of a single command. Which of the following is the BEST way to run `softwareupdate -iaR` while temporarily preventing system sleep?

nohup softwareupdate -iaR
pmset -a sleep 0; softwareupdate -iaR
caffeinate softwareupdate -iaR (Correct answer)
sleep 0; softwareupdate -iaR

Correct answer: caffeinate softwareupdate -iaR

The `caffeinate` command is designed to prevent sleep. When a command is passed as an argument to `caffeinate`, it creates a sleep assertion that remains active only for the life of that command's process. This is the most targeted and safest method, as sleep behavior returns to normal as soon as the command completes. Using `pmset` would change the system's settings persistently.

Question 68: A technician sees 'kernel_task' consuming a large percentage of CPU in Activity Monitor. What does elevated kernel_task CPU usage typically indicate?

The Secure Enclave is performing intensive cryptographic operations
A kernel extension has crashed and is being restarted
macOS is throttling CPU performance to manage thermal conditions (Correct answer)
The kernel is running software updates in the background

Correct answer: macOS is throttling CPU performance to manage thermal conditions

Elevated kernel_task CPU usage is typically macOS intentionally limiting CPU performance through thermal throttling to prevent overheating.

Question 69: Which macOS command-line tool can be used to display detailed information about disk partitions and their GUIDs?

gpt show
lsblk
diskutil list (Correct answer)
fdisk -l

Correct answer: diskutil list

The `diskutil list` command displays all disks and partitions including their types, sizes, and identifiers on macOS.

Question 70: What does it mean when a Mac displays a folder with a flashing question mark at startup?

The flashing folder means the Mac is in Target Disk Mode and searching for a host Mac
The Mac needs a firmware update that can only be installed from Recovery
The Mac cannot find a bootable operating system — the startup disk is not set, is missing, or its macOS installation is damaged (Correct answer)
The question mark indicates the Mac needs to be activated before first use

Correct answer: The Mac cannot find a bootable operating system — the startup disk is not set, is missing, or its macOS installation is damaged

A flashing folder with a question mark means the Mac's firmware cannot find a valid, bootable macOS installation. This can occur when: the startup disk is not set in System Settings, the macOS installation is corrupt, the internal drive has failed, or a new SSD was installed without macOS.

Question 71: Which command shows the current ARP table on a Mac, mapping IP addresses to MAC addresses on the local network?

ifconfig -arp
route -n get
netstat -r
arp -a (Correct answer)

Correct answer: arp -a

The 'arp -a' command displays the ARP cache, showing the mapping of IP addresses to hardware (MAC) addresses discovered on the local network.

Question 72: Which Apple technology allows APFS volumes to take near-instant snapshots of the entire volume state?

HFS+ Journal
APFS Snapshots (Correct answer)
APFS Clones
Time Machine Local Snapshots

Correct answer: APFS Snapshots

APFS (Apple File System) natively supports snapshots — point-in-time copies of a volume's state that are created nearly instantly and consume minimal additional space by using copy-on-write technology.

Question 73: A Mac with Apple silicon displays 'Your disk appears to be damaged' during startup. What is the first recommended step?

Initialize the disk from DFU mode
Boot to macOS Recovery and run First Aid in Disk Utility (Correct answer)
Reinstall macOS immediately
Replace the SSD

Correct answer: Boot to macOS Recovery and run First Aid in Disk Utility

Booting to macOS Recovery and running First Aid in Disk Utility is the first non-destructive step to diagnose and repair file system errors.

Question 74: What is the difference between 2.4GHz and 5GHz Wi-Fi bands in terms of macOS network performance?

2.4GHz and 5GHz perform identically; the difference is only in power consumption
5GHz works only outdoors; 2.4GHz is required for indoor use
2.4GHz is required for Apple devices; 5GHz is for Windows and Android only
5GHz offers higher speeds and less interference but shorter range; 2.4GHz offers longer range but slower speeds and more interference from other devices (Correct answer)

Correct answer: 5GHz offers higher speeds and less interference but shorter range; 2.4GHz offers longer range but slower speeds and more interference from other devices

5GHz Wi-Fi provides faster speeds (up to Wi-Fi 6 and 6E standards) and less interference (fewer competing devices use 5GHz) but has shorter range and worse penetration through walls. 2.4GHz travels farther through obstacles but is crowded and slower.

Question 75: What tool do administrators use to enforce system settings across managed Macs?

Keychain Access
Configuration Profiles (Correct answer)
Terminal Scripts
System Preferences Locks

Correct answer: Configuration Profiles

Configuration profiles (.mobileconfig files) deployed via MDM or manually enforce system settings and restrictions on managed Macs.

Question 76: A user installed software for a new peripheral, and now macOS displays a message that a 'Legacy System Extension' has been blocked and will be incompatible with future versions of macOS. This is most likely because the software is using:

An unsigned application bundle.
A modern DriverKit extension.
A sandboxed App Store application.
An outdated kernel extension (kext). (Correct answer)

Correct answer: An outdated kernel extension (kext).

macOS has been transitioning away from kernel extensions (kexts) because they operate in the system's kernel space, posing a higher security and stability risk. Apple now refers to these as 'legacy system extensions'. Modern peripherals and software should use user-space alternatives like DriverKit and System Extensions, which are more secure. An alert about a legacy extension indicates the software is using the older, less secure kext method.

Question 77: A support professional needs to analyze a user's Wi-Fi environment to troubleshoot poor performance. They want to view real-time data for Signal-to-Noise Ratio (SNR), Transmit Rate, and scan for nearby networks and their channels. Which built-in macOS utility provides access to these advanced tools?

The Network pane in System Settings
The `netstat` command in Terminal
Wireless Diagnostics (Correct answer)
Network Utility

Correct answer: Wireless Diagnostics

Wireless Diagnostics contains a suite of tools for in-depth Wi-Fi analysis. By holding the Option key while clicking the Wi-Fi icon in the menu bar, you can open Wireless Diagnostics, which includes utilities for performance monitoring, scanning, and logging that provide detailed metrics like SNR.

Question 78: A Mac's Wi-Fi adapter shows 'No Hardware Found' in System Settings. What is the recommended first troubleshooting step?

Delete all Wi-Fi preferred networks
Change the DNS server settings
Reinstall macOS
Reset the System Management Controller (SMC) (Correct answer)

Correct answer: Reset the System Management Controller (SMC)

Resetting the SMC resolves hardware recognition issues including Wi-Fi adapter detection failures on Intel-based Macs.

Question 79: A technician needs to enable Remote Management so IT can use Apple Remote Desktop. Which System Preferences pane provides this option?

Sharing (Correct answer)
Network
Security & Privacy
Users & Groups

Correct answer: Sharing

Remote Management (and Remote Desktop access) is enabled under the Sharing preference pane.

Question 80: After a macOS update, a user's USB-C hub no longer works. You isolate the issue to a specific kernel extension. Which macOS security feature most likely prevented it from loading?

System Integrity Protection (SIP) (Correct answer)
FileVault 2
Rapid Security Response
Gatekeeper

Correct answer: System Integrity Protection (SIP)

System Integrity Protection restricts third-party kernel extensions and requires user approval via System Settings > Privacy & Security before they can load.

Question 81: A user reports that their Mac connects to the corporate VPN successfully but cannot reach internal servers by hostname, only by IP. What is the most likely cause?

The Mac's firewall is blocking DNS queries
The VPN is not pushing internal DNS server settings to the Mac (Correct answer)
IPv6 is conflicting with the VPN's IPv4 tunnel
The VPN tunnel is using split tunneling

Correct answer: The VPN is not pushing internal DNS server settings to the Mac

When the VPN does not push internal DNS server addresses, the Mac continues using its default DNS servers which cannot resolve internal hostnames.

Question 82: What is the function of the hidden '/private/var/vm/' directory on macOS?

It stores virtual memory swap files that macOS uses when physical RAM is full (Correct answer)
It stores temporary installation files for macOS software updates
It contains cached versions of frequently accessed system files for faster loading
It contains virtual machine disk images for Virtualization.framework

Correct answer: It stores virtual memory swap files that macOS uses when physical RAM is full

The /private/var/vm/ directory contains macOS virtual memory swap files (swapfile0, swapfile1, etc.). When RAM is fully utilized, macOS writes less-used memory pages to these swap files on disk to free up physical RAM.

Question 83: How does macOS directory services integration with Active Directory work for user authentication?

Macs can join an Active Directory domain via System Settings > Users & Groups > Login Options, allowing AD users to authenticate with their domain credentials (Correct answer)
Active Directory integration on macOS is limited to read-only access of the AD user database
Macs can only join Active Directory using the 'dsconfigad' Terminal command; there is no GUI option
Active Directory integration requires installing Apple's macOS Server app on a Windows Server

Correct answer: Macs can join an Active Directory domain via System Settings > Users & Groups > Login Options, allowing AD users to authenticate with their domain credentials

macOS has built-in Active Directory (AD) integration. Macs can join an AD domain through System Settings > Users & Groups > Login Options > Join, or via the Terminal command 'dsconfigad'. Once joined, AD users can log in to the Mac using their domain username and password.

Question 84: How do you create a bootable macOS installer on a USB drive using Terminal?

Use the 'dd' command to write the macOS installer ISO to the USB drive
Use the 'createinstallmedia' tool included inside the macOS installer app with the command: sudo /Applications/Install\ macOS\ Sonoma.app/Contents/Resources/createinstallmedia --volume /Volumes/MyDrive (Correct answer)
Download the macOS installer from Software Update, then copy it to the USB drive in Finder
Use Disk Utility to restore the macOS installer .dmg file to the USB drive

Correct answer: Use the 'createinstallmedia' tool included inside the macOS installer app with the command: sudo /Applications/Install\ macOS\ Sonoma.app/Contents/Resources/createinstallmedia --volume /Volumes/MyDrive

The 'createinstallmedia' command-line tool, included inside macOS installer apps downloaded from the App Store, creates a properly formatted bootable USB installer. It erases and formats the target drive before copying all installer files.

Question 85: When restoring individual files from a Time Machine backup, which method allows you to browse backup snapshots without entering the Time Machine interface?

Using Migration Assistant and selecting specific files
Using the tmutil restore command in Terminal
Right-clicking a folder in Finder and choosing 'Browse Backups' with Time Machine open
Mounting the Time Machine backup disk and navigating the Backups.backupdb folder directly (Correct answer)

Correct answer: Mounting the Time Machine backup disk and navigating the Backups.backupdb folder directly

Time Machine backup disks contain a 'Backups.backupdb' folder with dated subfolders representing each backup snapshot. You can mount the drive in Finder and navigate this folder structure directly to copy files without using the Time Machine UI.

Question 86: A user returned their unmanaged iPad. You turn it on for a new user, and you discover that Activation Lock is turned on. What do you need to turn off Activation Lock?

The previous user’s Apple ID and password (Correct answer)
The new user’s Apple ID and password
Serial number of the iPad
The previous user’s Lost Mode PIN for the iPad

Correct answer: The previous user’s Apple ID and password

Explanation: You can’t turn off Activation Lock without the previous user’s Apple ID and password. If possible, ask the previous user to enter their credentials to turn off Activation Lock. Continue to study resources related to the following learning objective: Enter a bypass code on a managed device that has Activation Lock turned on.

Question 87: A Mac consistently shows a spinning globe instead of the Apple logo at startup. What does this indicate?

The Mac is attempting to boot from a NetBoot or network startup source because no valid local startup disk was found (Correct answer)
A firmware password is preventing access to the local drive
FileVault decryption is in progress on the startup volume
The Mac is running an iCloud sync before displaying the login window

Correct answer: The Mac is attempting to boot from a NetBoot or network startup source because no valid local startup disk was found

A spinning globe at startup means the Mac did not find a valid local startup disk and is searching for a bootable network source via NetBoot.

Question 88: A macOS administrator uses 'profiles' installed via System Preferences. What type of file format are configuration profiles distributed in?

.mobileconfig (Correct answer)
.cfg
.mdm
.plist

Correct answer: .mobileconfig

Configuration profiles are distributed as .mobileconfig files and can be installed via System Preferences > Profiles.

Question 89: What does 'Startup Security Utility' in macOS Recovery control for Apple silicon Macs?

It controls whether third-party bootloaders like GRUB can be installed alongside macOS
It controls the security policy: Full Security (default), Reduced Security (allows older OS), and Permissive Security (allows custom kernel extensions/SSV bypass) (Correct answer)
It manages the startup password that is required before macOS will load
It enables or disables the Secure Boot feature to allow booting from unsigned operating systems

Correct answer: It controls the security policy: Full Security (default), Reduced Security (allows older OS), and Permissive Security (allows custom kernel extensions/SSV bypass)

Startup Security Utility in Recovery for Apple silicon sets one of three security levels: Full Security (default, most secure), Reduced Security (allows older macOS or remote management), and Permissive Security (allows custom kernel extensions and disabling SSV — least secure).

Question 90: What is 'Activation Lock' on Apple silicon Macs, and how does it affect repair and resale?

Activation Lock prevents software installation unless the Mac is activated through Apple's developer portal
Activation Lock ties the Mac to an Apple ID via the Secure Enclave; the Mac cannot be set up until unlocked by the original owner or via Apple Business Manager (Correct answer)
Activation Lock is a screen lock that activates after multiple failed login attempts
Activation Lock prevents unauthorized hardware modifications by locking the T2/M-series chip configuration

Correct answer: Activation Lock ties the Mac to an Apple ID via the Secure Enclave; the Mac cannot be set up until unlocked by the original owner or via Apple Business Manager

Activation Lock on Macs (via Find My) ties the Mac's Secure Enclave to the owner's Apple ID. If Find My is enabled and the Mac is erased, setup requires the original owner's Apple ID credentials — preventing use of a stolen Mac after erasure.

Question 91: When configuring a login window to display a list of users rather than username and password fields, which setting is adjusted?

System Settings > General > Login Options > Display login window as: List of users
System Settings > Users & Groups > Show login window as list
Terminal: sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool false (Correct answer)
Users & Groups > Login Options > Show login window as: Name and password

Correct answer: Terminal: sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool false

The `defaults write` command for `SHOWFULLNAME -bool false` on com.apple.loginwindow switches the login window from name/password fields to a clickable list of users.

Question 92: Brian is trying to share his Personal Hotspot with Aga’s Mac. It isn’t working, and he asks you for help. You verify that his iPhone has the latest version of iOS and Personal Hotspot is turned on. Which troubleshooting step should Brian try next?

Tap Settings > General > Transfer or Reset > Reset > Reset Network Settings. (Correct answer)
Tap Settings > Personal Hotspot, then turn on Maximize Compatibility.
Turn off Low Power Mode.
Set the Allow Others to Join option to Ask.

Correct answer: Tap Settings > General > Transfer or Reset > Reset > Reset Network Settings.

Explanation: Resetting network settings on Brian’s iPhone is an appropriate next troubleshooting step. Continue to study resources related to the following learning objective: Troubleshoot Personal Hotspot connectivity issues.

Question 93: A user sees 'Security Policy' options in macOS Recovery on their Apple Silicon Mac. What does setting it to 'Reduced Security' allow?

Running macOS without a user password
Installing macOS from a non-Apple server
Disabling FileVault encryption permanently
Loading third-party kernel extensions (kexts) that are not notarized by Apple (Correct answer)

Correct answer: Loading third-party kernel extensions (kexts) that are not notarized by Apple

Reduced Security allows the Mac to load legacy or third-party kernel extensions that haven't passed Apple's notarization process.

Question 94: An ACSP technician needs to unload a Launch Daemon without rebooting. Which command achieves this?

sudo defaults delete /Library/LaunchDaemons/<plist>
sudo killall -9 <daemon>
sudo systemctl stop <daemon>
sudo launchctl bootout system /Library/LaunchDaemons/<plist> (Correct answer)

Correct answer: sudo launchctl bootout system /Library/LaunchDaemons/<plist>

The `launchctl bootout` command removes a Launch Daemon from the launchd bootstrap context without requiring a restart.

Question 95: What Apple feature, manageable through Apple Business Manager, replaced the Volume Purchase Program (VPP) for distributing app licenses to managed devices?

TestFlight Enterprise
Enterprise App Catalog
Apps and Books (Correct answer)
Mac App Store Business Edition

Correct answer: Apps and Books

Apps and Books in Apple Business Manager replaced the standalone VPP, allowing organizations to purchase and assign app and book licenses to users and devices via MDM.

Question 96: What are 'extended attributes' in macOS file system and how can they be viewed?

Additional file permissions stored in the ACL that extend beyond POSIX rwx bits
Metadata attached to files outside the normal file contents, viewable with 'xattr -l filename' in Terminal (Correct answer)
File tags and labels stored in a central macOS database separate from the file
Apple-specific file metadata stored in the file's resource fork on HFS+ volumes

Correct answer: Metadata attached to files outside the normal file contents, viewable with 'xattr -l filename' in Terminal

Extended attributes (xattrs) are arbitrary metadata attached to files and directories at the file system level, separate from the file's data. They're used for things like Quarantine flags, Finder tags, and custom metadata. Viewable with 'xattr -l filename'.

Question 97: A Mac is experiencing intermittent freezes and application crashes, which are suspected to be caused by a recently installed third-party kernel extension or a corrupt font cache. Which startup mode is the BEST first step for troubleshooting this specific type of issue?

Target Disk Mode
Safe Mode (Correct answer)
macOS Recovery
Single-User Mode

Correct answer: Safe Mode

Safe Mode is the ideal troubleshooting step for this scenario because it starts the Mac with a minimal set of software and services. Specifically, it loads only required kernel extensions, prevents third-party fonts from loading, and clears several system caches, including the font and kernel caches, directly addressing the suspected causes of the problem.

Question 98: Which directory stores Launch Agents that run in the context of the currently logged-in user?

/System/Library/LaunchDaemons/
/Library/LaunchDaemons/
~/Library/LaunchAgents/ (Correct answer)
/etc/launchd/

Correct answer: ~/Library/LaunchAgents/

Launch Agents in ~/Library/LaunchAgents/ run with the privileges of the logged-in user, making them user-scoped background tasks.

Question 99: A technician needs to clone a bootable macOS drive to a new SSD. Which tool is best suited for creating a bootable clone on Apple Silicon Macs?

Migration Assistant
Time Machine
Disk Utility Restore function
Carbon Copy Cloner or SuperDuper (Correct answer)

Correct answer: Carbon Copy Cloner or SuperDuper

Third-party tools like Carbon Copy Cloner or SuperDuper are designed to create bootable clones and handle APFS-specific structures and Apple Silicon requirements that Disk Utility's Restore may not fully replicate.

Question 100: A user wants to print from their iPhone to a printer on their home Wi-Fi network. Which technology enables this without installing an app?

Google Cloud Print
AirPrint (Correct answer)
Bluetooth printing
USB tethering

Correct answer: AirPrint

AirPrint is Apple's wireless printing protocol built into iOS and macOS that works with compatible printers over Wi-Fi without additional drivers or apps.

Apple Certified Support Professional (ACSP)

The ACSP certification validates the ability to support macOS users, troubleshoot issues, configure key services, and manage Apple devices in professional environments.

100

Questions

120 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds