macOS: System Architecture, Accounts, and Management
Core concepts
Candidates should be fluent in the layered macOS model: the Darwin UNIX foundation, core services, and the graphical layer. Know how launchd manages both system daemons and per-user agents, and how System Settings (formerly System Preferences) organizes configuration. Understand account types - administrator, standard, managed, and sharing-only - and that a standard user cannot install software system-wide or modify protected settings without authorization.
Know FileVault full-disk encryption tied to Secure Token and volume ownership, Gatekeeper and notarization for app launch control, and System Integrity Protection (SIP) protecting critical paths. Understand Time Machine local and network backups, snapshots, and how Migration Assistant and Target Disk Mode move data. For management, know MDM enrollment, configuration profiles, Declarative Device Management, and the difference between user-approved and automated enrollment.
Traps
Questions often blur Secure Token with FileVault enablement, or assume any admin can unlock a FileVault volume (only Secure Token holders can). Another trap: assuming deleting an app removes its preferences or launch agents - it usually does not. Watch for confusion between iCloud syncing and local account data.
Rule of thumb
If a setting is system-wide and security-sensitive, assume it requires admin authorization plus, for encryption, a Secure Token–enabled account. If it is per-user, look in that user's Library or iCloud settings.
Worked example
A user can't enable FileVault after an MDM reinstall. Because the account lacks a Secure Token, granting admin rights alone won't help - the token must be granted (often by an existing token holder or via MDM bootstrap token).