AE-C (NBRC) flashcards
AE-C · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- dscl local user read
- The command dscl . -read /Users/shortname prints a local account record, including UniqueID, PrimaryGroupID, and NFSHomeDirectory, letting you verify UID and home path mismatches.
- Secure token requirement
- On macOS, an account needs a secure token to unlock a FileVault volume, approve kernel extensions, or enable Touch ID for the login keychain. The first setup account normally holds one.
- Mobile account cache
- When a bound Mac authenticates a network user, it can cache credentials and create a local home folder. The account still logs in when the directory server is unreachable.
- dsconfigad show output
- This command reports the Active Directory domain, computer account name, and binding options such as mobile account caching and OU placement for a Mac joined to AD.
- UID 501 significance
- macOS reserves user IDs below 500 for system accounts. The first account created during setup normally receives UID 501, and duplicate UIDs cause ownership collisions on shared files.
- networksetup setmanual syntax
- networksetup -setmanual service ip mask gateway configures a static IPv4 address for a named network service; the service name must match exactly as listed by -listallnetworkservices.
- Service order and default route
- The order of network services determines which interface provides the default route when several are active. networksetup -listnetworkserviceorder prints the ranking.
- 169.254 self-assigned address
- An address in the 169.254.0.0/16 range means the interface could not obtain a DHCP lease. Check link status, DHCP scope, and whether the service is enabled and first in order.
- scutil dns resolver view
- scutil --dns prints the resolver configuration in effect, including split DNS scoped resolvers and search domains, which may override the servers listed in Network settings.
- 802.1X per-service config
- 802.1X authentication settings belong to each network service. EAP-TLS uses a client certificate; PEAP uses directory credentials. A configuration profile can supply either.
- POSIX mode bit values
- Read is 4, write is 2, and execute is 1, summed per owner, group, and other. chmod 750 grants the owner rwx, the group r-x, and others no access.
- ACL evaluation order
- macOS evaluates POSIX mode bits first, then ACL entries. ACLs can only grant additional permission, never remove what the mode bits already allow.
- Sticky bit on directories
- Setting the sticky bit on a shared directory limits deletion: users may remove only files they own, even when the directory permits write access for everyone.
- ACL inheritance flags
- file_inherit and directory_inherit flags on an ACL entry cause it to be copied to newly created files and folders inside that directory, propagating permissions automatically.
- SMB share permission layer
- An SMB share applies its own share-level permissions in addition to the file system's POSIX bits and ACLs. The most restrictive of the applicable layers governs access.
- lpstat and cancel
- lpstat -p lists configured print queues and their state; lpstat -o lists pending jobs. cancel -a queue clears all jobs from that queue.
- Driverless IPP queue
- A driverless queue uses an ipp:// or dnssd:// URI and requires no vendor PPD, relying on IPP Everywhere or AirPrint to supply capabilities and options.
- CUPS web interface port
- CUPS administration is reachable at http://localhost:631. cupsctl controls whether remote administration and the web interface are enabled on the machine.
- Stopped print queue
- A queue that stays paused is often disabled. cupsenable queue restarts printing and cupsaccept queue re-enables acceptance of new jobs.
- Keychain types
- The login keychain unlocks at login for one user, the System keychain is shared and unlocks at boot, and System Roots holds read-only trusted certificate anchors.
- spctl assess command
- spctl --assess --type execute path reports whether Gatekeeper would allow launching an app, based on signature, notarization, and current policy.
- FileVault recovery key
- FileVault 2 encrypts the startup volume and requires a recovery key, which can be institutional, personal, or escrowed to iCloud. Without it, a forgotten password means data loss.
- System Integrity Protection
- SIP blocks modification of protected paths such as /System, /usr, and /bin even by root. csrutil status reports it, and disabling requires booting into Recovery.
- Certificate trust settings
- Trust settings are stored per user or system-wide and can allow a certificate for one purpose, such as SSL, while denying it for another, such as code signing.
- DFU restore requirement
- Apple silicon and T2 Macs boot only sealed, signed system volumes, so legacy block-level imaging is replaced by DFU restore through Apple Configurator plus MDM enrollment.
- Startup Security policy
- Startup Security Utility in Recovery sets Full Security, which requires a signed OS and limits external boot, or Permissive, which allows booting other systems.
- MDM enrollment approval
- Modern macOS requires the user to approve MDM enrollment. Once enrolled, the MDM can push configuration profiles, install apps, and issue a Bootstrap token.
- Configuration profile format
- A configuration profile is a signed property list with a .mobileconfig extension. It is applied by MDM, by the Profiles settings pane, or with the profiles command.
- Automated Device Enrollment
- ADE assigns purchased or Configurator-added devices to an MDM during setup. Supervision, granted through ADE, enables restricted commands such as remote erase and non-removable profiles.
- Unified log query
- log show --predicate 'process == "name"' --last 1h searches the unified log for recent entries from a process; log stream follows entries live.
- Safe mode effect
- Safe mode loads only Apple-signed kernel extensions, clears system and font caches, and disables some login items, helping isolate third-party software as a cause.
- sysdiagnose collection
- The sysdiagnose tool gathers logs, spindumps, and system state into one archive for analysis, and is the standard first capture for an unexplained hang or crash.