ACSP macOS Platform Security (Gatekeeper, SIP, Notarization, XProtect)

Question 1

What is the primary purpose of Gatekeeper in macOS?

Accepted Answer

To verify that apps come from identified developers and have not been tampered with before allowing them to run

Answer

To encrypt files before they are written to the startup disk

Answer

To block unauthorized network connections from untrusted IP addresses

Answer

To prevent users without administrator privileges from installing any software

Question 2

What does Apple's notarization service verify when a developer submits an app?

Accepted Answer

That the app is signed with a valid Developer ID and has been scanned for known malware

Answer

That the app meets App Store visual design and Human Interface Guidelines

Answer

That the app has been manually reviewed by an Apple engineer for privacy compliance

Answer

That the app's binary size is under the limit for distribution outside the App Store

Question 3

A technician must disable System Integrity Protection (SIP) on an Intel-based Mac to install a low-level kernel extension. What is the correct procedure?

Accepted Answer

Boot into macOS Recovery (Command-R at startup), then run 'csrutil disable' in Terminal

Answer

Run 'sudo csrutil disable' in the standard macOS Terminal

Answer

Boot into Safe Mode, then run 'csrutil disable' in Terminal

Answer

Use Apple Configurator 2 to push a supervised profile that disables SIP remotely

Question 4

Which of the following actions does System Integrity Protection (SIP) prevent, even when executed with root or sudo privileges?

Accepted Answer

Modifying files located in /System, /usr, /bin, and /sbin

Answer

Installing third-party apps into /Applications

Answer

Creating new administrator user accounts via Terminal

Answer

Mounting external drives formatted with ExFAT

Question 5

A user on a Mac attempts to open a downloaded app that has not been notarized. What is the default Gatekeeper behavior on modern macOS?

Accepted Answer

macOS refuses to open the app and displays an alert stating it cannot be checked for malicious software

Answer

The app opens with a one-time warning notification in Notification Center

Answer

macOS quarantines the app and runs it in an isolated sandbox automatically

Answer

macOS submits the app to Apple for expedited notarization before allowing it to run

Question 6

What is the primary function of XProtect in macOS?

Accepted Answer

Scanning downloaded files and launched apps against a database of known malware signatures

Answer

Monitoring network traffic for intrusion attempts and blocking suspicious connections

Answer

Preventing apps from accessing the camera and microphone without user permission

Answer

Validating the cryptographic signature of the macOS kernel at each startup