ACSP Apps and Processes 5 — Questions and Answers
Question 1: A Mac app crashes repeatedly with a 'SIGABRT' signal. What does this signal most commonly indicate?
- Out-of-memory condition detected by the kernel
- The app called abort() due to an internal assertion failure (Correct answer)
- A network timeout forced the process to stop
- The app exceeded its sandbox file write limit
Correct answer: The app called abort() due to an internal assertion failure
SIGABRT is typically triggered when an app calls abort() after detecting an unrecoverable internal error such as a failed assertion.
Question 2: Where does macOS store crash reports generated for third-party apps for the current user?
- /var/log/crashes/
- ~/Library/Logs/DiagnosticReports/ (Correct answer)
- /Library/Logs/CrashReporter/
- /private/var/db/diagnostics/
Correct answer: ~/Library/Logs/DiagnosticReports/
User-level crash reports and diagnostic data for third-party apps are saved to ~/Library/Logs/DiagnosticReports/ by the ReportCrash agent.
Question 3: An app distributed outside the App Store fails to open with a warning that it 'cannot be opened because the developer cannot be verified.' What is the quickest supported resolution?
- Disable Gatekeeper permanently using spctl --master-disable
- Control-click the app and choose Open, then confirm in the dialog (Correct answer)
- Move the app to /Applications and try again
- Run xattr -d com.apple.quarantine on the app bundle
Correct answer: Control-click the app and choose Open, then confirm in the dialog
Control-clicking and selecting Open presents a dialog that allows the user to override Gatekeeper for that specific app without disabling the feature globally.
Question 4: What is the purpose of the 'quarantine' extended attribute that macOS assigns to downloaded files?
- It encrypts the file until a password is entered
- It flags the file for Gatekeeper review and prompts the user before first launch (Correct answer)
- It prevents Time Machine from backing up the file
- It restricts the file to read-only access
Correct answer: It flags the file for Gatekeeper review and prompts the user before first launch
The com.apple.quarantine extended attribute tells Gatekeeper to inspect and warn the user before allowing a downloaded file to run for the first time.
Question 5: A user's app is listed in Activity Monitor but has been unresponsive for 10 minutes. After using Force Quit, the user asks why the app's data may be lost. What is the correct explanation?
- Force Quit sends SIGKILL, which terminates the process immediately without giving it time to save state (Correct answer)
- Force Quit corrupts the app's preference file causing data loss
- macOS deletes the app container when Force Quit is used
- Force Quit requires administrator privileges which bypass file permissions
Correct answer: Force Quit sends SIGKILL, which terminates the process immediately without giving it time to save state
Force Quit sends SIGKILL to the process, which causes immediate termination by the kernel with no opportunity for the app to execute cleanup or save routines.
Question 6: Which macOS feature limits what resources and capabilities an app can access, even if the app's code attempts to access them?
- System Integrity Protection
- App Sandbox (Correct answer)
- Gatekeeper
- FileVault
Correct answer: App Sandbox
App Sandbox enforces a security boundary that restricts an app's access to system resources, files, and hardware based on entitlements declared at build time.
Question 7: A technician sees 'kernel_task' consuming a large percentage of CPU in Activity Monitor. What does elevated kernel_task CPU usage typically indicate?
- The kernel is running software updates in the background
- macOS is throttling CPU performance to manage thermal conditions (Correct answer)
- A kernel extension has crashed and is being restarted
- The Secure Enclave is performing intensive cryptographic operations
Correct answer: macOS is throttling CPU performance to manage thermal conditions
Elevated kernel_task CPU usage is typically macOS intentionally limiting CPU performance through thermal throttling to prevent overheating.
ACSP Apps and Processes 5
A Mac app crashes repeatedly with a 'SIGABRT' signal.
What does this signal most commonly indicate?