ACSP User Accounts and Security 4 — Questions and Answers
Question 1: A user reports that after resetting their Mac with Apple silicon, they cannot log in with their existing Apple ID. What is the most likely cause?
- Apple IDs are not supported on Apple silicon Macs
- The Mac requires an Activation Lock bypass code from Apple Business Manager (Correct answer)
- Apple ID login is disabled until MDM enrollment completes
- The user must create a local account before linking an Apple ID
Correct answer: The Mac requires an Activation Lock bypass code from Apple Business Manager
If a Mac is enrolled in Apple Business Manager or School Manager, Activation Lock prevents login until a bypass code is used or the device is released from MDM.
Question 2: Which command-line tool would a technician use to verify whether a local user account has a Secure Token on macOS?
- dscl . -read /Users/<username> SecureToken
- sysadminctl -secureTokenStatus <username> (Correct answer)
- security find-identity -v -p securetoken
- diskutil apfs listUsers /
Correct answer: sysadminctl -secureTokenStatus <username>
The `sysadminctl -secureTokenStatus <username>` command reports whether a given user holds a Secure Token.
Question 3: A Managed Apple ID differs from a personal Apple ID in that it:
- Cannot be used with iCloud Drive under any circumstances
- Is created and owned by an organization via Apple Business or School Manager (Correct answer)
- Requires a physical Apple device to activate
- Only supports App Store purchases, not Apple services
Correct answer: Is created and owned by an organization via Apple Business or School Manager
Managed Apple IDs are provisioned by administrators through Apple Business Manager or Apple School Manager and are owned by the organization, not the individual.
Question 4: On a shared Mac used by multiple local accounts, a technician notices that only one user can unlock FileVault at startup. What should the technician do to allow a second user to unlock the disk?
- Re-enable FileVault and select both users during setup
- Grant the second user administrator privileges only
- Use `sysadminctl -secureTokenOn <user2>` granting them a Secure Token (Correct answer)
- Add the second user to the wheel group via Terminal
Correct answer: Use `sysadminctl -secureTokenOn <user2>` granting them a Secure Token
A user must have a Secure Token to be listed as a FileVault-enabled user; granting a Secure Token via sysadminctl enables them to unlock the volume at startup.
Question 5: Screen Time communication limits on a family member's iPhone are managed from the parent's device via Family Sharing. Where are these settings configured on the parent's device?
- Settings > Screen Time > Family > [child's name] > Communication Limits (Correct answer)
- Settings > Family Sharing > [child's name] > Restrictions
- Settings > Privacy & Security > Communication Safety
- Settings > General > Parental Controls > Communication
Correct answer: Settings > Screen Time > Family > [child's name] > Communication Limits
Parents manage a child's Screen Time Communication Limits from their own device via Settings > Screen Time > the child's name under Family.
Question 6: A technician needs to bind a Mac to an Active Directory domain so that network user accounts can log in. Which built-in utility is used to configure this binding?
- Directory Utility (Applications > Utilities) (Correct answer)
- Network Preferences > Advanced > LDAP
- Keychain Access > Certificate Assistant
- System Information > Network > Directory Services
Correct answer: Directory Utility (Applications > Utilities)
Directory Utility (found in /System/Library/CoreServices/ or via Users & Groups preferences) is the macOS tool for binding to Active Directory and other directory services.
Question 7: Which macOS feature restricts which apps can access sensitive resources such as the camera, microphone, and contacts by maintaining a database of per-app permissions?
- Gatekeeper
- System Integrity Protection (SIP)
- Transparency, Consent, and Control (TCC) (Correct answer)
- Notarization
Correct answer: Transparency, Consent, and Control (TCC)
The TCC (Transparency, Consent, and Control) framework manages and enforces per-app privacy permissions for sensitive data categories like camera, microphone, and contacts.
ACSP User Accounts and Security 4
A user reports that after resetting their Mac with Apple silicon, they cannot log in with their existing Apple ID.
What is the most likely cause?