ACSP FileVault and Data Protection

Question 1

What does FileVault protect on a Mac, and under what specific condition does that protection apply?

Accepted Answer

It encrypts the startup volume so that data is inaccessible without the login password or recovery key when the Mac is powered off or the drive is physically removed

Answer

It encrypts network traffic to prevent eavesdropping while the Mac is connected to the internet

Answer

It prevents other local user accounts from reading files in a user's home folder while the Mac is running

Answer

It sandboxes applications to prevent them from reading files outside their designated containers

Question 2

How does FileVault on an Apple silicon Mac differ from FileVault on an Intel Mac?

Accepted Answer

On Apple silicon, FileVault leverages the Secure Enclave for hardware-accelerated encryption tightly integrated with the user's login credentials from first boot

Answer

Apple silicon uses software-only encryption; Intel Macs use hardware-accelerated encryption via the T2 chip

Answer

FileVault is optional on Intel Macs but cannot be disabled on Apple silicon Macs

Answer

Apple silicon Macs require an institutional recovery key; personal recovery keys are not supported

Question 3

What is the recommended enterprise practice for storing FileVault recovery keys on organization-managed Macs?

Accepted Answer

Escrow the institutional recovery key to the organization's MDM solution for centralized, secure retrieval

Answer

Print the key and store it in a locked filing cabinet at the office

Answer

Store the key in the user's personal iCloud account for easy self-service recovery

Answer

Email the recovery key to the IT department shared inbox immediately after enabling FileVault

Question 4

A user forgets their macOS login password on a FileVault-encrypted Intel Mac, and no recovery key was saved. What is the outcome for the data on that drive?

Accepted Answer

The data is permanently inaccessible; the drive must be erased and macOS reinstalled

Answer

Apple can decrypt the drive remotely using the Mac's serial number after identity verification

Answer

Booting to macOS Recovery provides a password reset option that bypasses FileVault automatically

Answer

Another local administrator account on the same Mac can reset the FileVault password without a recovery key

Question 5

Which command-line tool is used on macOS to enable FileVault, check its current status, and manage recovery keys?

Accepted Answer

fdesetup

Answer

diskutil

Answer

security

Answer

nvram

Question 6

An IT administrator runs 'fdesetup status' on a Mac and receives the output: 'FileVault is Off.' The Mac's startup disk contains sensitive HR data. What is the minimum correct next step to protect that data with FileVault?

Accepted Answer

Enable FileVault via System Settings > Privacy & Security > FileVault, or run 'sudo fdesetup enable', and ensure a recovery key is escrowed before the Mac restarts

Answer

Run 'sudo diskutil apfs encryptVolume / -user disk' to encrypt the volume directly

Answer

Reformat the drive with encryption enabled using Disk Utility, then restore from backup

Answer

FileVault cannot be enabled after macOS has already been installed; a clean install is required