Security: FileVault, Activation Lock, and Identity
Encryption and key escrow
FileVault 2 on macOS encrypts the startup volume. In managed environments, an institutional recovery key or a personal recovery key can be escrowed to MDM. A classic trap: FileVault enablement can be deferred, and the recovery key must be escrowed before the user is prompted, or the key may be lost. On iOS/iPadOS, data protection is always on; there is no user-facing FileVault toggle.
Activation Lock and Find My
Activation Lock ties a device to an Apple ID via Find My. In supervised environments, Activation Lock can be bypassed by MDM with the Activation Lock bypass code, but only if the device was supervised and the bypass code was escrowed. A common exam trap is assuming any enrolled device can bypass Activation Lock - it cannot; supervision and prior escrow are required.
Identity and certificates
Understand the role of MDM push certificates (APNs), SCEP for device identity, and the difference between device identity certificates and user certificates. Lost Mode, Remote Wipe, and Clear Passcode are security commands; Clear Passcode requires the device to be supervised or the passcode to be escrowed.
Worked rule of thumb
If a question asks how to recover a locked, wiped device still showing Activation Lock, the answer depends on supervision: supervised + bypass code escrowed → clear Activation Lock via MDM; otherwise the user's Apple ID credentials are required. Never assume enrollment alone grants bypass.