ACSP Startup and System Issues 5 — Questions and Answers
Question 1: A Mac consistently shows a spinning globe instead of the Apple logo at startup. What does this indicate?
- The Mac is attempting to boot from a NetBoot or network startup source because no valid local startup disk was found (Correct answer)
- The Mac is running an iCloud sync before displaying the login window
- FileVault decryption is in progress on the startup volume
- A firmware password is preventing access to the local drive
Correct answer: The Mac is attempting to boot from a NetBoot or network startup source because no valid local startup disk was found
A spinning globe at startup means the Mac did not find a valid local startup disk and is searching for a bootable network source via NetBoot.
Question 2: Which log file should a technician examine first to identify the cause of a recent kernel panic on macOS?
- /Library/Logs/DiagnosticReports/ for .panic files (Correct answer)
- /var/log/system.log for the most recent entries
- ~/Library/Logs/CrashReporter/ for user-space crashes
- /private/var/db/diagnostics/ for unified log archives
Correct answer: /Library/Logs/DiagnosticReports/ for .panic files
macOS writes a detailed .panic file to /Library/Logs/DiagnosticReports/ after each kernel panic, which contains the backtrace and loaded kexts at the time of the crash.
Question 3: A technician enables verbose mode on a Mac and notices the startup process halts after 'waiting for DSMOS.' What does this message indicate?
- The system is waiting for the Don't Steal Mac OS (FairPlay) kernel service to authorize the boot volume (Correct answer)
- A disk I/O error has paused the startup sequence
- The display driver failed to initialize
- FileVault pre-boot authentication timed out
Correct answer: The system is waiting for the Don't Steal Mac OS (FairPlay) kernel service to authorize the boot volume
DSMOS (Don't Steal Mac OS) is a macOS FairPlay kernel service that must complete authorization before user-space processes can start; a hang here often indicates a corrupted or tampered system.
Question 4: After a user enables FileVault, the Mac requires a password at pre-boot that is different from the login password. What has most likely occurred?
- A separate institutional recovery key or different enabled user was set as the pre-boot account (Correct answer)
- FileVault always uses a randomly generated PIN separate from the user password
- The login keychain password was changed after FileVault was enabled
- Secure Token was not granted to the user, so macOS generated a temporary password
Correct answer: A separate institutional recovery key or different enabled user was set as the pre-boot account
Only users who have been granted Secure Token and are enabled for FileVault pre-boot can unlock the drive; if a different account is set, that account's credentials are required at startup.
Question 5: Which command-line tool can a technician use in Terminal (booted from Recovery or a regular session) to verify and repair a startup volume's filesystem?
- fsck_apfs (Correct answer)
- diskutil repairDisk
- hdiutil verify
- mount -uw /
Correct answer: fsck_apfs
fsck_apfs is the low-level filesystem consistency check tool for APFS volumes and can detect and repair errors that Disk Utility's First Aid also invokes internally.
Question 6: A Mac running macOS Sonoma shows 'Your Mac restarted because of a problem' repeatedly but only after connecting a specific USB hub. What is the best diagnostic approach?
- Review the kernel panic report to identify the loaded kext or driver associated with the USB hub, then update or remove it (Correct answer)
- Reset NVRAM and reconnect the hub to see if the issue persists
- Run Apple Diagnostics to identify a hardware fault in the USB controller
- Reinstall macOS to ensure all USB drivers are at the correct version
Correct answer: Review the kernel panic report to identify the loaded kext or driver associated with the USB hub, then update or remove it
Kernel panic reports list all loaded kernel extensions at the time of the crash; identifying the USB-related kext in the backtrace points to the driver that needs to be updated or removed.
Question 7: A Mac with a T2 chip is set to 'Disallow booting from external or removable media' in Startup Security Utility. A technician needs to boot from an external macOS installer. What must the technician do first?
- Boot into Recovery, open Startup Security Utility, and change the external boot policy to allow it (Correct answer)
- Hold Option at startup to bypass the T2 security policy without any configuration change
- Use Apple Configurator 2 to temporarily disable the T2 chip's Secure Enclave
- Reset the SMC to clear the boot policy stored in the T2 chip
Correct answer: Boot into Recovery, open Startup Security Utility, and change the external boot policy to allow it
The T2 chip enforces boot policies set in Startup Security Utility; to allow external boot, a technician must enter Recovery (which requires the system password) and explicitly change the policy.
ACSP Startup and System Issues 5
A Mac consistently shows a spinning globe instead of the Apple logo at startup.
What does this indicate?