ACSP User Accounts and Security 5 — Questions and Answers
Question 1: A user's iCloud Keychain is not syncing to a newly set up Mac. After confirming the same Apple ID is signed in, what is the next most likely step to resolve the issue?
- Disable and re-enable Gatekeeper
- Ensure iCloud Keychain is toggled on in System Settings > Apple ID > iCloud (Correct answer)
- Delete and recreate the user's local Keychain file
- Reset the SMC on the new Mac
Correct answer: Ensure iCloud Keychain is toggled on in System Settings > Apple ID > iCloud
iCloud Keychain must be explicitly enabled per device in System Settings (or System Preferences) under Apple ID > iCloud; it does not enable automatically when signing in.
Question 2: An administrator wants to prevent a standard user from changing their own account password on macOS. Which tool allows this restriction to be applied locally?
- Keychain Access > Lock Screen preferences
- Screen Time > Content & Privacy > Allow Changes to Passcode
- Users & Groups > Right-click user > Disable Password Change
- Parental Controls (Screen Time) with the password change option disabled (Correct answer)
Correct answer: Parental Controls (Screen Time) with the password change option disabled
Screen Time (formerly Parental Controls) includes a Content & Privacy setting that can prevent a managed user from changing their account password.
Question 3: When configuring a login window to display a list of users rather than username and password fields, which setting is adjusted?
- System Settings > General > Login Options > Display login window as: List of users
- System Settings > Users & Groups > Show login window as list
- Terminal: sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool false (Correct answer)
- Users & Groups > Login Options > Show login window as: Name and password
Correct answer: Terminal: sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool false
The `defaults write` command for `SHOWFULLNAME -bool false` on com.apple.loginwindow switches the login window from name/password fields to a clickable list of users.
Question 4: A technician is troubleshooting why an APFS volume's FileVault recovery key cannot be used. The user insists the key was saved during setup. What is a common reason the personal recovery key fails?
- Personal recovery keys expire after 30 days
- The key was generated for a different volume or a prior FileVault enablement (Correct answer)
- Recovery keys only work on Intel Macs, not Apple silicon
- FileVault recovery keys require Touch ID to activate
Correct answer: The key was generated for a different volume or a prior FileVault enablement
If FileVault was turned off and re-enabled, a new recovery key is generated; any previously saved key is no longer valid for the current encryption state.
Question 5: Which macOS security feature prevents modification of system files and directories even by the root user, and must be disabled in recoveryOS to allow certain low-level changes?
- Gatekeeper
- FileVault
- System Integrity Protection (SIP) (Correct answer)
- Secure Boot
Correct answer: System Integrity Protection (SIP)
System Integrity Protection (SIP) restricts root-level modifications to protected system paths and can only be disabled by booting into recoveryOS and running `csrutil disable`.
Question 6: A company deploys Macs via Automated Device Enrollment (ADE). Which account is automatically created during the Setup Assistant enrollment flow when no MDM payload specifies otherwise?
- A Managed Apple ID account tied to the company's ABM domain
- A local administrator account created by the user during Setup Assistant (Correct answer)
- A guest account that is later converted to a standard user
- An MDM service account with hidden administrator privileges
Correct answer: A local administrator account created by the user during Setup Assistant
During ADE enrollment without a pre-staged account MDM payload, Setup Assistant prompts the user to create a local administrator account as normal.
Question 7: A user receives a Gatekeeper warning stating an app 'cannot be opened because it is from an unidentified developer.' What is the safest supported method to open the app once after verifying its source?
- Run `sudo spctl --master-disable` to turn off Gatekeeper permanently
- Right-click (or Control-click) the app in Finder and choose Open, then confirm in the dialog (Correct answer)
- Move the app to /Applications to bypass Gatekeeper automatically
- Add the app's bundle ID to the TCC database via Terminal
Correct answer: Right-click (or Control-click) the app in Finder and choose Open, then confirm in the dialog
Control-clicking the app and selecting Open presents a dialog that allows the user to run it once as an exception without disabling Gatekeeper system-wide.
ACSP User Accounts and Security 5
A user's iCloud Keychain is not syncing to a newly set up Mac.
After confirming the same Apple ID is signed in, what is the next most likely step to resolve the issue?