Free Apple Apple-Device-Support Practice Exam with Questions & Answers | Set: 2

APFS is a file system that supports encryption at the volume level. Each volume has its own encryption key, called the Volume Encryption Key (VEK), which is stored in the APFS container metadata and protected by another key, called the Key Encryption Key (KEK). The KEK is derived from the user’s password and wrapped by a secure token, which is a feature that ensures only authorized users can access the encrypted data.  According to the Apple Device Support Reference Materials 1 2 , the following scenarios cause APFS volumes to generate encryption keys:

During user creation. When a new user is created on an APFS volume, a secure token is generated for that user and a KEK is derived from the user’s password. The KEK is used to encrypt the VEK and store it in the metadata.

During the first user’s password creation. When the first user on an APFS volume sets their password, a secure token is granted to that user and a KEK is derived from the password. The KEK is used to encrypt the VEK and store it in the metadata.

After erase content and setting. When a user erases all content and settings on an APFS volume, the VEK and the KEK are deleted and new ones are generated. The new VEK is encrypted with the new KEK and stored in the metadata.

Holding Option and clicking the Wi-Fi menu bar icon reveals advanced options, including “Open Wireless Diagnostics,” which provides detailed network info.

Option B: Regular click shows basic options.

Option C: Right-click doesn’t target SSID for diagnostics.

Option D: Command key doesn’t trigger this.

The Activity Monitor Dock icon can display real-time Network Usage (e.g., data sent/received) if set in View > Dock Icon .

Option A: Storage is in System Settings > General > Storage.

Option B: Wi-Fi details are in Network settings.

Option D: Hardware is in System Information.

Activity Monitor allows running system diagnostics via View > Run System Diagnostics , generating a report for troubleshooting (saved in /var/tmp).

Option B: Console views logs, not runs diagnostics.

Option C: Feedback Assistant submits issues, not runs diagnostics directly.

Option D: Diagnostic Reporter isn’t a macOS app.

A Managed Apple Account, created by organizations via Apple Business Manager or Apple School Manager, is designed for institutional use and has restricted features compared to a personal Apple Account. While Managed Apple Accounts support iCloud services like iCloud Drive and iCloud Keychain for productivity and security, they do not include access to the Health app or Health data syncing. This limitation exists because Health data is personal and not relevant to organizational management, which focuses on work-related functionality.

Option A (iCloud Keychain) is available for password management in managed environments.

Option B (iCloud Drive) is supported for file storage and collaboration.

Option C (News) may be restricted in some configurations, but it’s not inherently unavailable with Managed Apple Accounts.

Option D (Health) is unavailable because it’s tied to personal health tracking, not organizational use. This is documented in Apple’s " Managed Apple Accounts " guide (support.apple.com/guide/apple-business-manager), which outlines supported features as of 2025.

macOS supports reading NTFS (Windows default) natively but only writes to it with third-party software. This matches the user’s read-only issue.

Option B: exFAT is fully read/write on macOS.

Option C: FAT32 is read/write compatible.

Option D: macOS Extended is macOS-native and read/write.

Dismissing a captive portal dialog (e.g., for public Wi-Fi) blocks internet access. Visiting captive.apple.com in a browser reopens the sign-in page.

Option B: MDM isn’t relevant for public Wi-Fi.

Option C: IP tracking doesn’t affect captive portals.

Option D: Private Wi-Fi address doesn’t fix this.

System Integrity Protection (SIP) restricts root user actions, protecting critical system files and processes from modification, even with admin privileges. Enabled by default since macOS Sierra.

Option A: XProtect scans for malware, not limits root.

Option B: Full Disk Access grants permissions, not restricts.

Option D: Secure Enclave handles encryption, not root limits.

With FileVault enabled, macOS Recovery requires unlocking the encrypted disk by selecting an admin user and entering their password at startup.

Option A: Disk Utility mounting isn’t the initial step.

Option C: MFA isn’t used here.

Option D: Recovery Lock is MDM-specific, not FileVault.

Managed Lost Mode (via MDM) locks a supervised iPad and displays a custom message, securing data remotely.

Option A: Activation Lock is preventive, not immediate.

Option C: Find My isn’t MDM-managed this way.

Option D: User action isn’t possible if missing.