ACSP FileVault and Data Protection — Questions and Answers
Question 1: What does FileVault protect on a Mac, and under what specific condition does that protection apply?
- It encrypts network traffic to prevent eavesdropping while the Mac is connected to the internet
- It encrypts the startup volume so that data is inaccessible without the login password or recovery key when the Mac is powered off or the drive is physically removed (Correct answer)
- It prevents other local user accounts from reading files in a user's home folder while the Mac is running
- It sandboxes applications to prevent them from reading files outside their designated containers
Correct answer: It encrypts the startup volume so that data is inaccessible without the login password or recovery key when the Mac is powered off or the drive is physically removed
FileVault uses XTS-AES-128 encryption on the startup volume. Its protection is specifically relevant at rest — when the Mac is shut down or the drive is removed, the ciphertext cannot be read without the decryption key. While the Mac is running and a user is logged in, the volume is mounted and accessible normally.
Question 2: How does FileVault on an Apple silicon Mac differ from FileVault on an Intel Mac?
- Apple silicon uses software-only encryption; Intel Macs use hardware-accelerated encryption via the T2 chip
- FileVault is optional on Intel Macs but cannot be disabled on Apple silicon Macs
- On Apple silicon, FileVault leverages the Secure Enclave for hardware-accelerated encryption tightly integrated with the user's login credentials from first boot (Correct answer)
- Apple silicon Macs require an institutional recovery key; personal recovery keys are not supported
Correct answer: On Apple silicon, FileVault leverages the Secure Enclave for hardware-accelerated encryption tightly integrated with the user's login credentials from first boot
Apple silicon Macs integrate data protection at the hardware level via the Secure Enclave, making FileVault encryption hardware-accelerated and tied to the user's login credential from the very first login. This is a deeper integration than the software-layer approach used on Intel Macs without a T2 chip.
Question 3: What is the recommended enterprise practice for storing FileVault recovery keys on organization-managed Macs?
- Print the key and store it in a locked filing cabinet at the office
- Store the key in the user's personal iCloud account for easy self-service recovery
- Escrow the institutional recovery key to the organization's MDM solution for centralized, secure retrieval (Correct answer)
- Email the recovery key to the IT department shared inbox immediately after enabling FileVault
Correct answer: Escrow the institutional recovery key to the organization's MDM solution for centralized, secure retrieval
Best practice in enterprise environments is to escrow FileVault institutional recovery keys to an MDM platform (such as Jamf, Kandji, or Microsoft Intune for Mac). This allows IT administrators to retrieve keys securely when users forget passwords, with full audit logging and without relying on insecure channels like email or paper.
Question 4: A user forgets their macOS login password on a FileVault-encrypted Intel Mac, and no recovery key was saved. What is the outcome for the data on that drive?
- Apple can decrypt the drive remotely using the Mac's serial number after identity verification
- Booting to macOS Recovery provides a password reset option that bypasses FileVault automatically
- The data is permanently inaccessible; the drive must be erased and macOS reinstalled (Correct answer)
- Another local administrator account on the same Mac can reset the FileVault password without a recovery key
Correct answer: The data is permanently inaccessible; the drive must be erased and macOS reinstalled
FileVault has no backdoor. Without the user's login password or a valid recovery key (personal or institutional), the encrypted volume cannot be decrypted — not by Apple, not from Recovery, and not by another administrator. The only option is erasing the drive, which destroys all data.
Question 5: Which command-line tool is used on macOS to enable FileVault, check its current status, and manage recovery keys?
- diskutil
- security
- fdesetup (Correct answer)
- nvram
Correct answer: fdesetup
'fdesetup' (Full Disk Encryption Setup) is the dedicated CLI tool for managing FileVault. Common subcommands include 'fdesetup status' to check whether FileVault is on or off, 'fdesetup enable' to turn it on, and 'fdesetup changerecovery' to rotate recovery keys. The 'diskutil' tool manages volumes and partitions but does not control FileVault.
Question 6: An IT administrator runs 'fdesetup status' on a Mac and receives the output: 'FileVault is Off.' The Mac's startup disk contains sensitive HR data. What is the minimum correct next step to protect that data with FileVault?
- Run 'sudo diskutil apfs encryptVolume / -user disk' to encrypt the volume directly
- Enable FileVault via System Settings > Privacy & Security > FileVault, or run 'sudo fdesetup enable', and ensure a recovery key is escrowed before the Mac restarts (Correct answer)
- Reformat the drive with encryption enabled using Disk Utility, then restore from backup
- FileVault cannot be enabled after macOS has already been installed; a clean install is required
Correct answer: Enable FileVault via System Settings > Privacy & Security > FileVault, or run 'sudo fdesetup enable', and ensure a recovery key is escrowed before the Mac restarts
FileVault can be enabled on an already-running Mac through System Settings > Privacy & Security > FileVault, or via 'sudo fdesetup enable' in Terminal. macOS will then encrypt the volume in the background while the Mac remains usable. Critically, the institutional or personal recovery key must be captured and escrowed before the Mac restarts to ensure recovery access.
ACSP FileVault and Data Protection
What does FileVault protect on a Mac, and under what specific condition does that protection apply?