Practice Test GeeksACSP - Apple Certified Support Professional Practice Test
← All ACSP Flashcard Decks

FileVault and Data Protection Flashcards

6 cards from real ACSP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 FileVault and Data Protection flashcards as text

  1. What does FileVault protect on a Mac, and under what specific condition does that protection apply?

    Answer: It encrypts the startup volume so that data is inaccessible without the login password or recovery key when the Mac is powered off or the drive is physically removed

    FileVault uses XTS-AES-128 encryption on the startup volume. Its protection is specifically relevant at rest — when the Mac is shut down or the drive is removed, the ciphertext cannot be read without the decryption key. While the Mac is running and a user is logged in, the volume is mounted and accessible normally.

  2. How does FileVault on an Apple silicon Mac differ from FileVault on an Intel Mac?

    Answer: On Apple silicon, FileVault leverages the Secure Enclave for hardware-accelerated encryption tightly integrated with the user's login credentials from first boot

    Apple silicon Macs integrate data protection at the hardware level via the Secure Enclave, making FileVault encryption hardware-accelerated and tied to the user's login credential from the very first login. This is a deeper integration than the software-layer approach used on Intel Macs without a T2 chip.

  3. What is the recommended enterprise practice for storing FileVault recovery keys on organization-managed Macs?

    Answer: Escrow the institutional recovery key to the organization's MDM solution for centralized, secure retrieval

    Best practice in enterprise environments is to escrow FileVault institutional recovery keys to an MDM platform (such as Jamf, Kandji, or Microsoft Intune for Mac). This allows IT administrators to retrieve keys securely when users forget passwords, with full audit logging and without relying on insecure channels like email or paper.

  4. A user forgets their macOS login password on a FileVault-encrypted Intel Mac, and no recovery key was saved. What is the outcome for the data on that drive?

    Answer: The data is permanently inaccessible; the drive must be erased and macOS reinstalled

    FileVault has no backdoor. Without the user's login password or a valid recovery key (personal or institutional), the encrypted volume cannot be decrypted — not by Apple, not from Recovery, and not by another administrator. The only option is erasing the drive, which destroys all data.

  5. Which command-line tool is used on macOS to enable FileVault, check its current status, and manage recovery keys?

    Answer: fdesetup

    'fdesetup' (Full Disk Encryption Setup) is the dedicated CLI tool for managing FileVault. Common subcommands include 'fdesetup status' to check whether FileVault is on or off, 'fdesetup enable' to turn it on, and 'fdesetup changerecovery' to rotate recovery keys. The 'diskutil' tool manages volumes and partitions but does not control FileVault.

  6. An IT administrator runs 'fdesetup status' on a Mac and receives the output: 'FileVault is Off.' The Mac's startup disk contains sensitive HR data. What is the minimum correct next step to protect that data with FileVault?

    Answer: Enable FileVault via System Settings > Privacy & Security > FileVault, or run 'sudo fdesetup enable', and ensure a recovery key is escrowed before the Mac restarts

    FileVault can be enabled on an already-running Mac through System Settings > Privacy & Security > FileVault, or via 'sudo fdesetup enable' in Terminal. macOS will then encrypt the volume in the background while the Mac remains usable. Critically, the institutional or personal recovery key must be captured and escrowed before the Mac restarts to ensure recovery access.