CCNA Macos Security Questions

MCQmedium

A user reports they cannot open a downloaded application because macOS states the developer cannot be verified. Which security feature is preventing the execution of this application?

A.XProtect

B.Gatekeeper

C.System Integrity Protection

D.FileVault 2

AnswerB

Gatekeeper is the security feature that checks if an application is signed by an identified developer and notarized by Apple. If an application fails these checks, Gatekeeper prevents it from executing to ensure that the software has not been altered or created by an untrusted entity.

Why this answer

Gatekeeper is the security technology that verifies that software is from a trusted developer and has not been tampered with. By requiring code signing and notarization, Gatekeeper helps prevent the execution of malicious software. For a GSEC professional, recognizing Gatekeeper's role is key to troubleshooting deployment issues while maintaining the organization's security policy, as it is the first line of defense against unauthorized applications running on the user's desktop.

Exam trap

Candidates often confuse Gatekeeper with XProtect or FileVault, mixing up the application verification framework with antivirus signatures or disk encryption technologies.

Practice this question →

MCQeasy

A compliance officer wants to confirm that full disk encryption is active on a MacBook so that data at rest is protected if the device is lost. Which command should the officer run to check the FileVault status?

A.fdesetup status

B.csrutil status

C.spctl --status

D.diskutil apfs list

AnswerA

fdesetup status reports whether FileVault is On or Off and, when in progress, the percentage of encryption completed. It directly answers the compliance question about full disk encryption being active on the MacBook, making it the correct tool for verifying FileVault state.

Why this answer

FileVault is macOS full disk encryption, and its state is queried with the fdesetup utility. Running fdesetup status returns whether encryption is on, off, or in progress, which is precisely the evidence a compliance officer needs to confirm data-at-rest protection. Other tools report unrelated security features such as SIP or Gatekeeper.

Exam trap

The trap here is confusing volume-level APFS encryption reporting from diskutil with the user-facing FileVault configuration that fdesetup reports.

Practice this question →

MCQeasy

A user attempts to launch a newly installed application on a macOS Monterey system, but the application fails to open with a message that it cannot be verified. The user is certain the application was downloaded from the developer's official website. Which macOS feature is responsible for this behavior?

A.XProtect

B.Gatekeeper

C.System Integrity Protection (SIP)

D.Transparency, Consent, and Control (TCC)

AnswerB

Gatekeeper is the macOS feature that verifies the authenticity and integrity of applications downloaded from the internet. It checks whether the app is notarized by Apple and signed with a valid Developer ID. If the app cannot be verified, Gatekeeper blocks it from launching, which matches the scenario. This is the primary defense against malware disguised as legitimate software.

Why this answer

Gatekeeper is designed to ensure that only trusted software runs on macOS. When an application is downloaded from the internet, Gatekeeper checks its code signature and notarization status. If the app is not signed with a valid Developer ID or not notarized, Gatekeeper blocks it and displays a warning.

This matches the user's experience. The other features address different security aspects and would not produce this specific message.

Exam trap

The trap here is confusing Gatekeeper with other macOS security features like SIP or TCC, which handle different protection layers and do not verify app authenticity.

Practice this question →

MCQmedium

What is the primary purpose of the 'Notarization' process for macOS applications?

A.To provide full-disk encryption for the application data.

B.To scan for malicious code and verify developer identity.

C.To restrict application access to user contact data.

D.To enforce system-level integrity of the kernel.

AnswerB

Notarization uses automated tools to scan applications for known malware and verify that they are properly signed by a verified Apple Developer account. This ensures that users are protected from installing malicious software, acting as a crucial pre-execution security check for all macOS applications.

Why this answer

Notarization is an automated system that scans software for malicious content and verifies that it is signed by a registered developer. It provides a level of assurance to users that the software has been reviewed by Apple. For GSEC, understanding notarization is crucial because it bridges the gap between basic code signing and runtime execution, ensuring that even signed software meets baseline security standards before deployment.

Exam trap

Candidates often assume notarization is purely for software distribution or licensing, missing the critical security component where Apple scans for malicious code before execution.

Practice this question →

Multi-Selecthard

Which TWO of the following actions are primarily restricted by macOS System Integrity Protection (SIP)?

Select 2 answers

A.Modifying files within the /System directory

B.Installing unsigned applications from the internet

C.Loading unsigned kernel extensions (kexts)

D.Accessing user-defined keychain items

E.Encrypting the user home directory

AnswersA, C

The /System directory contains core macOS components that are essential for system stability and security. SIP explicitly prevents the root user from writing to or modifying files in this path, ensuring that core binaries and libraries remain untampered throughout the lifecycle of the operating system.

Why this answer

SIP is a crucial security layer that limits root user capabilities to prevent system-level damage. By restricting modifications to protected system directories and kernel extensions, it effectively hardens the operating system against exploitation. For GSEC professionals, identifying what SIP protects is vital for performing system audits, troubleshooting software installations, and managing secure configurations, as these restrictions often impact how security agents and administrative tools interact with the underlying OS.

Exam trap

Candidates often assume SIP restricts user-space application installation, whereas SIP specifically targets system-level modifications and kernel extensions to prevent deep OS-level compromise.

Practice this question →

MCQmedium

Refer to the exhibit. An administrator runs the provided command on a macOS device to verify the security configuration. Given the output, what is the most appropriate interpretation regarding the security posture of this endpoint?

A.The endpoint is vulnerable to root-level system file modification.

B.The endpoint's kernel integrity protections are actively enforced.

C.The disk encryption configuration is currently failing.

D.The device has been successfully compromised by a kernel rootkit.

AnswerB

When SIP status is reported as enabled, the kernel is protected from unsigned extensions and unauthorized modifications. This is the intended behavior for a secure macOS deployment, ensuring that only trusted components can execute at the lowest levels of the operating system, thereby mitigating risks from malicious drivers.

Why this answer

The output confirms that System Integrity Protection is currently active on the host. This status indicates that the core OS protections are enforced, preventing unauthorized modification of system-protected locations and restricted kernel operations. In a GSEC context, confirming the status of SIP is a primary validation step during an incident response or security audit, as disabling SIP is a common technique used by attackers to gain persistence and evade detection on macOS.

Exam trap

Candidates often confuse SIP status output with other security features like Gatekeeper or FileVault, or they incorrectly assume that 'active' status implies the system is currently free of malware.

Practice this question →

MCQhard

A security administrator is configuring a macOS Big Sur endpoint to meet a compliance requirement that mandates all system extensions must be explicitly approved by the user. Which command should the administrator use to verify that only approved system extensions are loaded?

A.systemextensionsctl list

B.csrutil status

C.spctl --status

D.kextstat

AnswerA

The systemextensionsctl list command displays all installed system extensions and indicates whether each is approved by the user or pending approval. This directly addresses the compliance requirement to verify that only approved system extensions are loaded. It provides the necessary status information to confirm user approval.

Why this answer

System extensions are a modern replacement for kernel extensions and require user approval before they can load. The systemextensionsctl list command provides a detailed list of all system extensions along with their approval status. This allows administrators to verify that only approved extensions are present, meeting the compliance requirement.

The other commands either list kernel extensions or check different security features, so they do not provide the needed information.

Exam trap

The trap here is conflating system extensions with kernel extensions; systemextensionsctl list is the correct tool for system extensions, while kextstat is for kernel extensions.

Practice this question →

Multi-Selectmedium

A security analyst is investigating a macOS Monterey system that may have been compromised. The analyst wants to check for signs of malicious kernel extensions. Which TWO of the following commands or tools are most appropriate for this task? (Choose two.)

Select 2 answers

A.kmutil showloaded

B.spctl --assess --verbose

C.kextstat

D.systemextensionsctl list

E.csrutil status

AnswersA, C

The kmutil showloaded command displays information about currently loaded kernel extensions and other kernel collections. It is a modern replacement for kextstat and provides detailed output that can help identify unauthorized or malicious kexts. It is an appropriate tool for investigating kernel-level compromise on macOS.

Why this answer

To check for malicious kernel extensions, an analyst should use tools that list loaded kexts. The kextstat command provides a list of loaded kernel extensions, while kmutil showloaded offers similar information with more detail. Both are appropriate for identifying unauthorized kexts.

The other commands focus on system extensions, SIP status, or Gatekeeper assessments, which do not directly reveal loaded kernel extensions.

Exam trap

The trap here is confusing system extensions with kernel extensions; systemextensionsctl list does not show kernel extensions, and csrutil or spctl do not list loaded kexts.

Practice this question →

MCQmedium

A security administrator is configuring a macOS fleet to enforce that only apps signed with an Apple-issued Developer ID certificate and notarized by Apple can run. The administrator wants to verify the current Gatekeeper assessment status of a downloaded app at /Users/analyst/Downloads/Tool.app. Which command should the administrator use to perform this check?

A.xattr -l /Users/analyst/Downloads/Tool.app

B.codesign --verify --deep --strict /Users/analyst/Downloads/Tool.app

C.system_profiler SPApplicationsDataType

D.spctl --assess --type execute --verbose /Users/analyst/Downloads/Tool.app

AnswerD

The spctl command is the system policy control tool that evaluates Gatekeeper assessments. Using --assess with --type execute and --verbose against the app path returns whether the app is accepted by Gatekeeper and the reason for rejection, directly confirming notarization and Developer ID signing status for the specified app.

Why this answer

Gatekeeper assessment is performed by the spctl utility, which consults system policy to decide whether an app is permitted to execute. Running spctl with the assess action, the execute type, and verbose output against the target app returns an acceptance or rejection verdict along with the reason, which directly reflects Developer ID signing and notarization requirements enforced on the endpoint.

Exam trap

The trap here is assuming that verifying the code signature with codesign proves Gatekeeper will allow the app, when signature integrity and Gatekeeper policy are separate checks.

Practice this question →

MCQmedium

An organization requires that all employee MacBook Pro devices prevent unauthorized modifications to the system kernel. Which macOS security feature should the administrator focus on to ensure that only Apple-signed code executes at the kernel level?

A.FileVault 2

B.Gatekeeper

C.System Integrity Protection (SIP)

D.XProtect

AnswerC

System Integrity Protection restricts the root user from modifying protected locations like /System, /bin, and /usr. By enforcing signed kernel extensions and preventing unauthorized modifications to system processes, it directly protects the kernel integrity, ensuring that only trusted, Apple-approved code can operate at the system core level.

Why this answer

System Integrity Protection (SIP) is the macOS feature designed to restrict the root user from performing actions that could compromise system integrity. By enforcing kernel-level protection, SIP prevents malicious code from injecting into system processes or modifying protected files. Understanding SIP is critical for GSEC candidates as it represents the foundational boundary between user-space applications and sensitive kernel operations, serving as a primary defense against rootkits and low-level system tampering.

Exam trap

Candidates frequently mistake Gatekeeper or XProtect for SIP, failing to recognize that SIP is specifically the mechanism that enforces kernel-level integrity and prevents root-level modifications.

Practice this question →