This chapter covers macOS Terminal commands essential for the CompTIA A+ Core 2 (220-1102) exam, specifically under Objective 1.6: Explain common macOS features and tools. The Terminal is a powerful command-line interface that allows direct interaction with the Unix-based operating system. Mastery of basic commands for file management, process control, and system information retrieval is critical, as approximately 5-10% of exam questions touch on macOS command-line tools. This chapter provides a thorough, exam-focused exploration of the most frequently tested commands and their practical applications.
Jump to a section
Imagine you're a mechanic in a high-end workshop. The macOS Finder is like a basic toolbox with screwdrivers and wrenches—great for simple tasks like opening apps or copying files. But for complex jobs, you need a full power tool workshop: that's the Terminal. The Terminal gives you direct, text-based access to the Unix foundation of macOS. Think of each command as a specialized power tool. For example, ls is like a laser measuring tape that instantly lists all items in a drawer; cd is like stepping into a different room; cp is like a duplicating machine that makes exact copies; rm is like an industrial shredder—once used, files are gone. The command line interface (CLI) is the control panel where you type these tool names. The shell (like bash or zsh) is the workshop foreman that interprets your typed instructions and executes them. You can chain tools together with pipes (|) like an assembly line—output from one tool feeds directly into the next. For instance, ls -la | grep '.txt' uses the listing tool, then pipes to a filtering tool to show only text files. Scripts are like pre-recorded sequences of tool operations that can be run with one command. This workshop is incredibly powerful but also dangerous: a single wrong command can shred the entire workshop. That's why understanding each tool's function and options is critical. The exam tests your ability to navigate this workshop safely and efficiently.
What is the macOS Terminal and Why Does It Exist?
The macOS Terminal is a command-line interface (CLI) application that provides direct access to the underlying Unix operating system. macOS is built on Darwin, an open-source Unix-like operating system derived from BSD (Berkeley Software Distribution). The Terminal allows users to interact with the system using text commands rather than the graphical user interface (GUI). This is essential for tasks that are difficult or impossible to perform via the GUI, such as scripting, automating repetitive tasks, viewing hidden files, managing permissions, and troubleshooting network issues. The exam tests knowledge of basic Terminal commands because many IT professionals rely on the CLI for efficient system administration and problem-solving.
How the Terminal Works Internally
When you open the Terminal app, it launches a shell program. The default shell in macOS has changed over time: from bash (Bourne Again SHell) in earlier versions to zsh (Z shell) starting with macOS Catalina (10.15). The shell acts as an interpreter between the user and the operating system kernel. When you type a command and press Enter, the shell parses the command line, expands any wildcards or variables, and then executes the corresponding program. The program may be a built-in shell command, an executable file in the system PATH, or a user-defined script. The output is sent to stdout (standard output), which by default appears in the Terminal window. Errors are sent to stderr (standard error), also displayed by default. The shell returns an exit status (0 for success, non-zero for failure) that can be used in scripting.
Key Components: Commands, Options, and Arguments
Every command line consists of three parts: the command itself, options (also called flags), and arguments. Options modify the behavior of the command and are usually preceded by a hyphen (single-letter options, e.g., -l) or double hyphen (long options, e.g., --list). Arguments are the targets of the command, such as filenames, directories, or text strings. For example:
ls -la /UsersHere, ls is the command, -l and -a are options (combined as -la), and /Users is the argument (the directory to list).
Essential File Management Commands
`pwd` – Print Working Directory. Displays the full path of the current directory. No arguments or options needed. Example output:
/Users/student`ls` – List directory contents. Common options:
- -l : long format showing permissions, owner, size, modification date
- -a : include hidden files (those starting with a dot)
- -h : human-readable sizes (e.g., 1K, 234M)
- -R : recursive listing of subdirectories
Exam tip: ls -la is the most common combination to see all files including hidden ones with details.
`cd` – Change Directory. Syntax: cd [directory]. If no directory is given, it goes to the user's home directory. Special directories:
- . : current directory
- .. : parent directory
- ~ : home directory
- - : previous directory
Example: cd /System/Library moves to the System Library directory.
`mkdir` – Make Directory. Syntax: mkdir [options] directory_name. Use -p to create parent directories as needed. Example: mkdir -p projects/2025/reports creates the entire path.
`rmdir` – Remove Directory. Only works on empty directories. For non-empty directories, use rm -r.
`cp` – Copy files or directories. Syntax: cp [options] source destination. Common options:
- -r : recursive (copy directories)
- -i : interactive (prompt before overwrite)
- -p : preserve attributes (timestamps, permissions)
- -v : verbose (show what is being copied)
Exam trap: Many candidates forget -r when copying directories, leading to an error.
`mv` – Move or rename files/directories. Syntax: mv [options] source destination. Options include -i for interactive and -v for verbose. Unlike cp, mv does not require -r for directories.
`rm` – Remove files or directories. Syntax: rm [options] target. Options:
- -r : recursive (delete directories and their contents)
- -f : force (ignore nonexistent files and never prompt)
- -i : interactive (prompt before each removal)
Danger: rm -rf / is a notoriously destructive command that deletes everything. The exam may test that rm does not move files to Trash—they are permanently deleted.
`touch` – Create an empty file or update a file's timestamp. Syntax: touch filename. If the file exists, its access and modification timestamps are updated to the current time. If it doesn't exist, an empty file is created.
`file` – Determine file type. Syntax: file filename. It examines the file's contents to identify the type (e.g., ASCII text, JPEG image, Mach-O 64-bit executable).
Viewing and Editing Files
`cat` – Concatenate and display file contents. Syntax: cat [options] file. Use -n to number lines. For large files, less or more is better.
`less` – View file contents page by page. Press Space to go forward, b to go back, q to quit. It does not load the entire file into memory, making it efficient for large files.
`head` – Display the first lines of a file. Default is 10 lines. Use -n to specify a different number: head -n 20 file.txt.
`tail` – Display the last lines of a file. Default is 10 lines. Use -f to follow a file as it grows (useful for log files). tail -f /var/log/system.log shows new log entries in real time.
`nano` – A simple command-line text editor. Syntax: nano filename. Common shortcuts: Ctrl+O to save, Ctrl+X to exit, Ctrl+W to search. The exam may expect you to know nano as a default terminal editor in macOS.
Permissions and Ownership
Every file and directory has permissions for three categories: owner, group, and others. Permissions are read (r=4), write (w=2), and execute (x=1). The ls -l command shows permissions as a string like -rwxr-xr--. The first character indicates the type (- for file, d for directory). The next nine characters are three groups of three: owner, group, others.
`chmod` – Change file permissions. Syntax: chmod [options] mode file. Mode can be symbolic (e.g., u+x adds execute for owner) or octal (e.g., 755). Example: chmod 755 script.sh sets owner rwx, group r-x, others r-x.
`chown` – Change file owner and/or group. Syntax: chown [options] owner[:group] file. Example: chown student:staff file.txt sets owner to student and group to staff.
`umask` – Set default permissions for new files. The umask is a three-digit octal value that subtracts permissions from the default. Default file permissions are 666 (rw-rw-rw-), but with umask 022, new files get 644 (rw-r--r--). Use umask without arguments to see current value.
Process Management
`ps` – Display running processes. Syntax: ps [options]. Common options:
- aux : all processes from all users (a), detailed format (u), including those without a terminal (x). Example: ps aux shows every process with CPU/memory usage.
- -ef : standard Unix format listing all processes.
`top` – Dynamic real-time view of running processes. Press q to quit. Shows PID, %CPU, %MEM, and more. top -l 1 runs once and exits.
`kill` – Terminate a process by PID. Syntax: kill [signal] PID. Common signals:
- TERM (15): graceful termination (default)
- KILL (9): force kill (cannot be ignored)
- HUP (1): hang up (often used to reload config files)
Example: kill -9 1234 forcefully terminates PID 1234.
`killall` – Terminate processes by name. Syntax: killall [signal] process_name. Example: killall -KILL Finder restarts the Finder.
Network Commands
`ping` – Test network connectivity to a host. Syntax: ping [options] host. Press Control+C to stop. Options:
- -c count : stop after count packets (e.g., ping -c 4 google.com)
- -i interval : seconds between packets (default 1)
- -t ttl : set Time To Live
`ifconfig` – Display or configure network interfaces. Syntax: ifconfig [interface]. Common use: ifconfig en0 shows Ethernet interface details. ifconfig en0 down disables the interface (requires root).
`netstat` – Display network connections, routing tables, interface statistics. Syntax: netstat [options]. Common options:
- -r : show routing table
- -a : show all sockets
- -n : show numeric addresses instead of names
Example: netstat -rn shows the routing table with numeric IPs.
`nslookup` – Query DNS servers for domain name or IP address. Syntax: nslookup domain. Example:
nslookup apple.comReturns the IP address(es) associated with the domain.
`dig` – More advanced DNS lookup tool. Syntax: dig [options] domain. Example: dig apple.com returns detailed DNS information.
`traceroute` – Trace the route packets take to a host. Syntax: traceroute host. Shows each hop (router) along the path. Useful for diagnosing network latency or routing issues.
`arp` – Display or modify the ARP (Address Resolution Protocol) cache. Syntax: arp -a shows all entries. arp -d hostname deletes an entry.
System Information Commands
`uname` – Print system information. Syntax: uname [options]. Options:
- -a : all information (kernel name, hostname, kernel release, kernel version, machine hardware)
- -m : machine hardware name (e.g., x86_64, arm64)
- -r : kernel release
`system_profiler` – Detailed hardware and software configuration report. Syntax: system_profiler [datatype]. Example: system_profiler SPHardwareDataType shows CPU, memory, serial number, etc. system_profiler SPSoftwareDataType shows macOS version, boot volume, etc.
`sw_vers` – Show macOS version information. Example output:
ProductName: macOS
ProductVersion: 14.5
BuildVersion: 23F79`df` – Display disk free space. Syntax: df [options]. Common options:
- -h : human-readable sizes (GB, MB)
- -H : human-readable in powers of 1000
Example: df -h shows all mounted filesystems with usage.
`du` – Estimate file space usage. Syntax: du [options] [directory]. Options:
- -h : human-readable
- -s : summary (total only)
- -c : grand total
Example: du -sh /Users/student/Documents shows total size of the Documents folder.
`dmesg` – Display kernel ring buffer messages. Useful for hardware diagnostics. Syntax: dmesg | grep -i error filters for errors.
Utility Commands
`echo` – Display a line of text. Syntax: echo [string]. Often used in scripts to output messages or variable values.
`grep` – Search for patterns in files or output. Syntax: grep [options] pattern [file]. Common options:
- -i : case-insensitive
- -r : recursive
- -v : invert match (show lines that do NOT match)
- -n : show line numbers
Example: grep -r 'error' /var/log searches all log files for 'error'.
`find` – Search for files in a directory hierarchy. Syntax: find [path] [expression]. Example: find /Users -name '*.pdf' -type f finds all PDF files under /Users.
`which` – Locate a command's executable path. Syntax: which command. Example: which python3 returns /usr/bin/python3 if installed.
`sudo` – Execute a command as another user (typically root). Syntax: sudo command. The user must be in the sudoers file. Example: sudo system_profiler SPHardwareDataType runs the profiler with root privileges.
`man` – Display the manual page for a command. Syntax: man command. Press q to exit. Example: man ls shows all options for ls.
How Terminal Commands Interact with macOS
Terminal commands directly interact with the Darwin kernel and system frameworks. For example, system_profiler calls the IOKit framework to query hardware. ps reads process information from the kernel's process table. ifconfig uses the Berkeley Packet Filter (BPF) to manipulate network interfaces. Understanding that the Terminal provides a lower-level interface than the GUI helps in troubleshooting: if a GUI tool fails, the Terminal often reveals the underlying error.
The exam expects you to know that many Terminal commands require root privileges (using sudo) for system-level changes. Also, be aware that macOS has some unique commands like mdfind (Spotlight search from CLI) and diskutil (disk management) that are not present in standard Linux.
Open Terminal and Identify Shell
Launch Terminal from Applications/Utilities or via Spotlight. By default, the shell is zsh (since macOS Catalina). You can verify with `echo $SHELL`. The prompt typically shows username and current directory (e.g., `student@Mac ~ %`). The `~` indicates the home directory. Understanding the shell environment is crucial because different shells have slightly different syntax. For the exam, focus on zsh and bash, as both are common. The shell reads input line by line, expanding variables and executing commands.
Navigate the File System
Use `pwd` to print the current directory. Use `cd` to change directories. Practice absolute paths (starting with `/`) and relative paths (starting with `.` or `..`). For example, `cd /System/Library` moves to a system directory. `cd ~/Documents` moves to the user's Documents folder. `cd ..` moves up one level. The shell maintains a directory stack; `cd -` returns to the previous directory. Efficient navigation is key for file management tasks.
List Files with Details
Use `ls -la` to list all files (including hidden ones) in long format. The output shows permissions, number of hard links, owner, group, size, modification date, and filename. Hidden files start with a dot (e.g., `.bash_profile`). The `-h` option makes sizes human-readable (e.g., `1.2M`). For a recursive listing, use `-R`. This command is essential for verifying file existence and permissions. The exam may test interpretation of `ls -la` output, especially permission strings.
Create, Copy, Move, and Delete Files
Create an empty file with `touch newfile.txt`. Create a directory with `mkdir newdir`. Copy a file with `cp source dest`. To copy a directory, use `cp -r sourcedir destdir`. Move or rename with `mv oldname newname`. Delete a file with `rm filename`. Delete a directory and its contents with `rm -rf dirname`. Be cautious: `rm` permanently deletes files; there is no Trash. The `-i` flag prompts before each deletion. The exam often tests the difference between `cp` and `mv`, and that `rm -r` is needed for directories.
View and Edit File Contents
Use `cat` to display a file's contents. For large files, use `less` to view page by page (press Space to advance, `q` to quit). Use `head -n 20` to see the first 20 lines, and `tail -f` to follow a log file in real time. To edit files from the terminal, use `nano`. For example, `nano ~/.bash_profile` edits the shell configuration. The exam expects you to know these basic viewing and editing commands for troubleshooting configuration files.
Manage Permissions
Use `chmod` to change permissions. For example, `chmod 755 script.sh` sets read/write/execute for owner, read/execute for group and others. Use `chown` to change ownership: `chown student:staff file.txt`. Use `umask` to set default permissions. Understanding the octal permission system (rwx = 421) is critical. The exam may ask how to make a script executable (e.g., `chmod +x script.sh`) or how to interpret permission strings like `-rwxr-xr--`.
Monitor and Control Processes
Use `ps aux` to list all running processes with details. `top` provides a dynamic view. To terminate a process, use `kill PID` (graceful) or `kill -9 PID` (force). `killall processname` kills all processes with that name. For example, `killall -KILL Finder` restarts the Finder. The exam may test which signal to use for a forced termination (SIGKILL, signal 9).
In enterprise IT environments, the macOS Terminal is indispensable for system administration, automation, and troubleshooting. Here are three common scenarios:
1. Automated User Account Creation and Management
Many organizations deploy macOS devices in bulk using MDM solutions like Jamf Pro. However, administrators often need to create local user accounts via Terminal for testing or emergency access. Using sysadminctl (e.g., sudo sysadminctl -addUser jdoe -password P@ssw0rd -admin) is faster than navigating System Preferences. Scripts combine dscl (Directory Service command line utility) to create home directories and set permissions. A common issue is forgetting to set the shell, leading to login problems. The dscl command is powerful but complex; misconfiguration can lock users out. Performance is not a concern, but accuracy is critical.
2. Log Analysis and Troubleshooting
When a Mac experiences kernel panics or application crashes, the GUI may become unresponsive. Terminal commands like log show --predicate 'eventMessage contains "panic"' --last 1h retrieve system logs from the unified logging system. grep and awk are used to filter large log files. For example, grep -i 'error' /var/log/system.log | tail -50 shows the last 50 error messages. Network issues are diagnosed with ping, traceroute, and nslookup. A misconfigured DNS server can cause slow browsing; dig reveals the exact response. In production, administrators often run tail -f on critical logs to monitor real-time events.
3. Disk Management and Recovery
When a Mac fails to boot, Terminal access from Recovery Mode (Command+R at startup) allows disk repair using diskutil. For example, diskutil verifyVolume /Volumes/Macintosh\ HD checks the file system. fsck -fy is an older tool but still used. In enterprise deployments, administrators use diskutil to partition disks, create RAID sets, or erase volumes securely (e.g., diskutil secureErase 0 /dev/disk2). A common mistake is specifying the wrong disk identifier, which can wipe critical data. Always use diskutil list first to identify the correct disk. Scale considerations: large disk arrays may take hours to verify, so scheduling during maintenance windows is wise.
For the 220-1102 exam, Objective 1.6 specifically includes "macOS: Terminal commands". The exam tests your ability to recall and apply basic CLI commands for file management, process control, and system information. Here are the key focus areas:
Most Common Wrong Answers and Why Candidates Choose Them:
1. Confusing `cp` and `mv`: Many candidates think mv copies and then deletes the original, but they forget that mv does not require -r for directories. They choose an option that says "use mv -r to move a directory" – but mv works without -r. The correct answer is that mv moves directories without any flag.
2. Thinking `rm` moves files to Trash: In the GUI, deleting moves to Trash. In Terminal, rm permanently deletes. Candidates often select an answer that says files can be recovered from Trash after using rm. The reality is that rm does not use Trash; files are unlinked immediately.
3. Misunderstanding the `-f` flag in `rm`: Some believe -f stands for "file" or "force remove" but think it bypasses write protection. While -f does force removal without prompting, it does not override file permissions entirely; it only suppresses errors for nonexistent files. The exam may test that rm -f still requires write permission on the directory.
4. Confusing `chmod` and `chown`: Candidates often swap the purposes. chmod changes permissions (mode), chown changes ownership. A typical wrong answer says "use chmod to change the owner of a file."
Specific Numbers, Values, and Terms That Appear Verbatim:
- The octal permissions: 7=rwx, 6=rw-, 5=r-x, 4=r--, etc.
- Signal numbers: SIGTERM=15, SIGKILL=9, SIGHUP=1.
- The ls -la command is often the correct answer to view all files with details.
- sudo is required for system-level commands (e.g., modifying /etc files).
- man command displays the manual.
Edge Cases the Exam Loves to Test:
- What happens when you run cd with no arguments? It goes to the home directory.
- What does touch do if the file already exists? It updates the timestamp, not overwrite.
- How to recursively copy a directory? cp -r.
- How to force kill a process? kill -9 PID.
- How to see disk space in human-readable format? df -h.
How to Eliminate Wrong Answers:
Understand the underlying mechanism. For example, if a question asks about making a script executable, the answer must involve chmod +x or chmod 755. If an option says chmod 777, that would give write permission to everyone, which is insecure but still executable. The exam expects security awareness, so 755 is often preferred over 777. For process termination, if the question says "process is not responding to kill PID", the answer is kill -9 PID because SIGKILL cannot be caught or ignored.
The default shell in macOS since Catalina is zsh; earlier versions used bash.
`ls -la` lists all files including hidden ones in long format.
`cp -r` is required to copy directories; `mv` does not need `-r`.
`rm` permanently deletes files without sending to Trash.
`chmod 755` sets rwx for owner, r-x for group and others.
`kill -9` sends SIGKILL (signal 9) to force terminate a process.
`sudo` grants root privileges for system commands.
`man` displays the manual page for any command.
These come up on the exam all the time. Here's how to tell them apart.
macOS Terminal (zsh)
Unix-based, case-sensitive commands
Uses forward slashes in paths
Commands like `ls`, `cp`, `mv`, `rm`
Supports pipes and redirection
Scripting with bash/zsh syntax
Windows Command Prompt (cmd.exe)
Windows-based, case-insensitive commands
Uses backslashes in paths (but forward slashes often work)
Commands like `dir`, `copy`, `move`, `del`
Supports pipes and redirection
Scripting with batch file syntax
Mistake
Terminal commands are the same as Linux commands.
Correct
While macOS is Unix-based and shares many commands with Linux, there are differences. For example, macOS uses `system_profiler` instead of `lshw`, and `diskutil` instead of `fdisk`. Some command options differ (e.g., `ps aux` works on both, but `ps -ef` is more common on Linux). The exam expects macOS-specific commands where relevant.
Mistake
The `rm` command sends files to the Trash.
Correct
`rm` permanently deletes files by unlinking them from the file system. There is no Trash or recycle bin. Once removed, data recovery is difficult without specialized tools. Candidates must remember that `rm` is irreversible through normal means.
Mistake
You need to use `sudo` for all Terminal commands.
Correct
`sudo` is only required for commands that affect system-wide settings or files owned by root. Most user-level commands like `ls`, `cd`, `cp`, and `mv` work without `sudo`. Overusing `sudo` can lead to permission errors or security risks.
Mistake
The `chmod 777` command is always the best way to give full permissions.
Correct
`chmod 777` gives read, write, and execute to everyone, which is a security risk. In practice, `755` (owner full, others read/execute) is more common for scripts, and `644` for files. The exam may test secure permission practices.
Mistake
Terminal commands cannot be undone.
Correct
While some commands like `rm` are destructive, others like `mv` can be reversed by moving the file back. The `cp` command creates a copy, leaving the original. Understanding which commands are reversible helps in troubleshooting.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
`cp` copies a file or directory to a new location, leaving the original intact. `mv` moves or renames a file/directory; the original is removed. For directories, `cp` requires the `-r` option, while `mv` does not. Both commands can overwrite existing files unless the `-i` option is used to prompt. On the exam, remember that `mv` does not need `-r` and that `cp` without `-r` will fail on directories.
Use `chmod +x script.sh` or `chmod 755 script.sh`. The `+x` adds execute permission for all users. The octal `755` sets rwx for owner, r-x for group and others. After making it executable, run it with `./script.sh` (if in current directory) or provide the full path. The exam expects you to know that `chmod` changes permissions, not `chown`.
`sudo` (superuser do) allows a permitted user to execute a command as the superuser or another user, as specified in the sudoers file. Use it only when a command requires root privileges, such as modifying system files (e.g., `/etc/hosts`), installing software system-wide, or changing system settings. Overusing `sudo` can lead to accidental damage. The exam may test that `sudo` is required for commands like `system_profiler` to access hardware details or `diskutil` to manage disks.
Use `ps aux` to list all processes from all users with detailed information (CPU, memory, etc.). For a real-time dynamic view, use `top`. To find a specific process, pipe to `grep`: `ps aux | grep Safari`. To kill a process, use `kill PID` or `killall ProcessName`. The exam often tests `ps aux` as the standard command for viewing all processes.
`man` displays the manual page for a command, providing documentation on its syntax, options, and usage. For example, `man ls` shows all options for the `ls` command. Press `q` to exit the manual viewer. The exam expects you to know that `man` is the primary help system in Unix-like operating systems.
Use `df -h` to see disk space usage for all mounted filesystems in human-readable format (e.g., GB, MB). Use `du -sh /path/to/directory` to see the total size of a specific directory. The `-h` flag is commonly tested. Remember that `df` reports free space, while `du` reports used space.
`kill` terminates a process by its PID (process ID). `killall` terminates all processes with a given name. For example, `kill -9 1234` kills process with PID 1234, while `killall -KILL Finder` restarts the Finder. The exam may test that `killall` uses the process name, not the PID.
You've just covered macOS Terminal Commands — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?