RANGER GAMEZ

Apple Device Support · chapter 17 of 18

Month 9: Locked out and locked down

In this chapter Objectives 6.13, 6.14, 6.15, 6.16, 6.17, 6.18

  1. Why FileVault matters
  2. Unlocking a FileVault volume
  3. How Activation Lock protects devices
  4. Organization-linked vs user-linked Activation Lock
  5. Managed Lost Mode
  6. Stolen Device Protection and Lockdown Mode
  7. Coming in iOS 27: Platform SSO at the login window and FileVault unlock
  8. Why turn on FileVault
  9. Unlocking a FileVault volume
  10. Activation Lock
  11. Organization-linked vs user-linked
  12. Managed Lost Mode
  13. Stolen Device Protection and Lockdown Mode
  14. Practice questions
  15. Chapter recap

Objective 6.13

Why FileVault matters

Encryption with a password on top

On a Mac with Apple silicon, user data is encrypted automatically. FileVault adds a layer: the login password is needed to decrypt the data, even with the Mac in hand, so a stolen Mac's files stay protected. It also requires a password after sleep or the screen saver and protects macOS Recovery from non-admins. Only an administrator (or MDM) can turn it on.

Exam tip Organizations escrow the recovery key in their MDM service so keys aren't lost and IT can help with resets.

Check yourself 1Who can turn on FileVault on a Mac?

  1. An administrator, or the device management service
  2. Any standard user
  3. A Guest User
  4. Only Apple Support, after checking proof of purchase
Show the answer

Answer: A. An administrator, or the device management service

To turn on FileVault, the user must be an administrator on the Mac. A device management administrator can also turn it on and have the service store the recovery key.

Objective 6.14

Unlocking a FileVault volume

Ways in

Users unlock the disk with their login password (other users must be enabled for FileVault by an admin). When FileVault is turned on, the user also picks a backup: let their iCloud account unlock the disk, or create a recovery key. A personal recovery key (PRK) escrowed in MDM can be used at the login window with 'Reset it using your recovery key'.

  • macOS 26 or later: unlock over ssh after a restart if Remote Login is on and the Mac is on the network
  • Lost password AND lost recovery key, and no other reset: the data is gone for good

Check yourself 2A second user on a FileVault Mac can't unlock the disk at startup with her password. What's the likely cause?

  1. Only admins can unlock FileVault
  2. FileVault allows one user per Mac
  3. Her account wasn't enabled for FileVault
  4. Her password is too long
Show the answer

Answer: C. Her account wasn't enabled for FileVault

Other users unlock the disk with their own passwords once enabled. If there's an Enable Users button, an admin must enter each user's password.

Objective 6.15

How Activation Lock protects devices

Find My turns it on

On a personal device, turning on Find My turns on Activation Lock: Apple links the Apple Account to the device on its activation servers. The Apple Account password or device passcode is needed to turn off Find My, erase, or reactivate it, even after a remote erase. The lock screen ('iPhone Locked to Owner') shows part of the account to hint which one is needed.

Exam tip Macs need Apple silicon or the T2 chip for Activation Lock. Ask users to sign out before handing a device back.

Check yourself 3What turns on Activation Lock on a user-owned iPhone?

  1. Setting a passcode
  2. Turning on iCloud Backup
  3. Enrolling in MDM
  4. Turning on Find My
Show the answer

Answer: D. Turning on Find My

Turning on Find My automatically turns on Activation Lock. Apple then stores the Apple Account on its activation servers and links it to the device.

Check yourself 4Which credential lets someone turn off Find My, erase or reactivate a device with Activation Lock on?

  1. The device's serial number
  2. The Wi-Fi password
  3. The linked Apple Account password or the device passcode
  4. Any Managed Apple Account that belongs to the same organization
Show the answer

Answer: C. The linked Apple Account password or the device passcode

The Apple Account password or device passcode is required before anyone can turn off Find My, erase the device, or reactivate and use it.

Objective 6.16

Organization-linked vs user-linked Activation Lock

Two kinds on company devices

Organization-linked needs Apple Business Manager or Apple School Manager; the device management service turns it on and off server-side. User-linked needs a personal (unmanaged) Apple Account with Find My on, on a device where MDM allows Activation Lock. If both are tried, the first successful one wins.

  • Clear user-linked: the user's Apple Account, Apple Business Manager, or the stored MDM bypass code
  • iPhone/iPad bypass codes: retrievable up to 15 days after first supervision
  • Mac: Recovery Assistant > Activate with MDM key; iPhone: code in the password field, user name blank
  • Dual SIM: the clear request needs both IMEIs

Check yourself 5What does organization-linked Activation Lock require?

  1. Each user's personal Apple Account with Find My on
  2. A Managed Apple Account signed in on the device each time it's set up again
  3. Apple Business Manager or Apple School Manager, with MDM controlling it
  4. Apple Configurator on a Mac
Show the answer

Answer: C. Apple Business Manager or Apple School Manager, with MDM controlling it

Organization-linked Activation Lock requires Apple School Manager or Apple Business Manager. The device management service fully controls turning it on and off through server-side interactions.

Check yourself 6An MDM service reports an error when clearing Activation Lock on a dual-SIM iPhone. Which detail should be checked?

  1. That the iPhone has two Apple Accounts signed in, one per SIM
  2. That both SIMs have the same carrier
  3. That both IMEI values are included in the request
  4. That the iPhone is in Lockdown Mode
Show the answer

Answer: C. That both IMEI values are included in the request

To clear Activation Lock on devices that support dual SIMs, the device management service must include both IMEI values in the request. Also check that both bypass codes were stored.

Objective 6.17

Managed Lost Mode

Lock and locate company devices

Find My isn't available with a Managed Apple Account, so organizations use Managed Lost Mode on supervised iPhone and iPad. It locks the user out, shows a custom Lock Screen message (like a phone number), lets MDM query the location even with Location Services off, can play a sound and turns on Low Power Mode. Only the administrator can turn it off; the user is then told the location was collected.

Exam tip A lost company Mac gets a remote lock with a six-digit PIN and a message instead.

Check yourself 7What is Managed Lost Mode for?

  1. Letting a user find, lock or erase their own personal iPhone with Find My
  2. Letting an organization lock and locate a lost supervised iPhone or iPad
  3. Encrypting a Mac's startup disk
  4. Blocking sophisticated spyware
Show the answer

Answer: B. Letting an organization lock and locate a lost supervised iPhone or iPad

Organizations use a device management service to put lost or stolen supervised iPhone or iPad devices in Managed Lost Mode, which locks the user out and helps locate and secure the device.

Check yourself 8What appears on the Lock Screen of an iPhone in Managed Lost Mode?

  1. The owner's Apple Account email address
  2. A countdown showing when the iPhone will erase itself if it isn't found
  3. A message the MDM administrator can customize, such as a phone number
  4. The device's current GPS coordinates
Show the answer

Answer: C. A message the MDM administrator can customize, such as a phone number

The Lock Screen displays a message that the device management administrator can customize, for example a phone number to call if the device is found.

Check yourself 9A driver finds his company iPhone, but it's in Managed Lost Mode. How does he get back in?

  1. Enter his passcode
  2. Restart the iPhone
  3. Ask the MDM admin to turn it off
  4. Sign in with his Managed Apple Account
Show the answer

Answer: C. Ask the MDM admin to turn it off

Turning off Managed Lost Mode in the device management service is the only way out. The user is then told it was on and that the location was collected.

Objective 6.18

Stolen Device Protection and Lockdown Mode

Stolen Device Protection (iPhone)

Away from familiar locations (home, work), some actions need Face ID or Touch ID with no passcode fallback: saved passwords and passkeys, saved payment methods, turning off Lost Mode, erasing. Critical changes such as the Apple Account password, passcode or turning SDP off also add a security delay (up to an hour) and a second biometric check.

Exam tip Users can set it to always require these steps, even at familiar locations.

Lockdown Mode

Lockdown Mode is an optional, extreme protection for the very few people who might be personally targeted by sophisticated spyware. It blocks most Messages attachments and link previews, limits FaceTime from unknown callers, some web technologies and shared albums, won't auto-join nonsecure Wi-Fi, turns off 2G and blocks new configuration profiles and enrollment. Calls and SOS still work. Turn it on in Privacy & Security, on each device.

Mr. Barkley: So Lockdown Mode is for spies, not for me.

Priya: Stolen Device Protection is for you. Lockdown Mode, probably not.

Check yourself 10With Stolen Device Protection on and the iPhone away from familiar places, what does using a password saved in the Passwords app require?

  1. Face ID or Touch ID, with no passcode fallback
  2. The device passcode only
  3. An hour's security delay before the password can be used
  4. Approval from another Apple device
Show the answer

Answer: A. Face ID or Touch ID, with no passcode fallback

Away from familiar locations, Stolen Device Protection requires Face ID or Touch ID for actions like using saved passwords or passkeys, using saved payment methods in Safari and erasing all content and settings.

Check yourself 11Who is Lockdown Mode designed for?

  1. Every user who wants better battery life
  2. Shared iPads in schools
  3. Users who often lose their devices and want them to lock automatically
  4. The few people who may be personally targeted by sophisticated attacks
Show the answer

Answer: D. The few people who may be personally targeted by sophisticated attacks

Lockdown Mode is an optional, extreme protection for the very few individuals who, because of who they are or what they do, might be personally targeted by highly sophisticated digital threats.

Go deeper

More on the objectives in this chapter, in the same exam-ready detail.

Objective 6.14 · Coming in iOS 27, iPadOS 27 and macOS Golden Gate (preview note, phase 1).

Coming in iOS 27: Platform SSO at the login window and FileVault unlock

What changes in the 27 releases

On macOS Golden Gate 27, Platform SSO can authenticate with the organization's identity provider (OpenID) at FileVault unlock, the Lock Screen and the login window, including multi-factor and QR code sign-in. It can require Touch ID or Apple Watch, supports captive networks at login, and FileVault supports Authenticated Guest mode.

Exam tip Coming in iOS 27: not on the iOS 26 exam (last exams Oct 30, 2026). Apple's iOS 27 course opens Oct 29, 2026.

Objective 6.13 · Explain the benefits of volume encryption with FileVault.

Why turn on FileVault

A password on top of encryption

Apple silicon Macs encrypt user data automatically. FileVault adds the requirement of a login password to decrypt the data, even if someone has the Mac in hand. It also requires a password after sleep or the screen saver, and only administrators can use macOS Recovery. Only an admin (or MDM) can turn it on; organizations escrow the recovery key in MDM.

Objective 6.14 · List the methods for unlocking a FileVault volume.

Unlocking a FileVault volume

Ways to unlock

FileVault unlocks with:

  • The login password of a user enabled for FileVault (admins enable other users)
  • The user's iCloud account, if they chose that when turning FileVault on
  • The recovery key: personal, or escrowed in the device management service
  • macOS 26 or later: over ssh after a restart, if Remote Login is on and the Mac is online

Exam tip Forgot the password, can't reset it and lost the recovery key? The data is gone for good.

Objective 6.15 · Describe how Activation Lock protects Apple devices.

Activation Lock

Find My turns it on

Turning on Find My turns on Activation Lock: Apple links the Apple Account to the device. The account password or device passcode is needed to turn off Find My, erase or reactivate it, even after a remote erase. The lock screen shows part of the account as a hint. Macs need Apple silicon or the T2 chip.

Exam tip Lost the Apple Account for a personal device? iforgot.apple.com, then Apple Support with proof of purchase.

Objective 6.16 · Differentiate between organization-linked and user-linked Activation Lock.

Organization-linked vs user-linked

Two kinds

Organization-linked: needs Apple Business Manager or Apple School Manager; the MDM service turns it on and off server-side. User-linked: a personal Apple Account with Find My, on a device where MDM allows it.

  • Clear user-linked: the user's account, Apple Business Manager, or the stored bypass code
  • iPhone/iPad bypass code: retrievable up to 15 days after first supervision
  • Mac: Recovery Assistant > Activate with MDM key
  • Dual SIM: the clear request needs both IMEIs; if both kinds are used, the first one wins

Objective 6.17 · Explain the purpose of using Managed Lost Mode on Apple devices.

Managed Lost Mode

For lost company devices

Find My isn't available with a Managed Apple Account, so organizations put supervised iPhone and iPad into Managed Lost Mode: the user is locked out, a custom message shows, MDM can get the location even with Location Services off and play a sound, and Low Power Mode turns on. Only the admin can turn it off; the user is then told. A lost Mac gets a remote lock with a six-digit PIN.

Objective 6.18 · Explain how Stolen Device Protection and Lockdown Mode help improve privacy and security.

Stolen Device Protection and Lockdown Mode

Stolen Device Protection

Away from familiar locations, some actions need Face ID or Touch ID with no passcode fallback (saved passwords, payment methods, erasing, turning off Lost Mode). Critical changes (Apple Account password, passcode, turning SDP off) add a security delay of up to an hour and a second biometric check.

Lockdown Mode

Optional, extreme protection for the very few people personally targeted by sophisticated spyware. It limits Messages attachments, FaceTime from unknown callers, some web features, nonsecure Wi-Fi and 2G, and blocks new profiles and MDM enrollment. Calls and SOS still work. Turned on per device in Privacy & Security.

Practice questions

Answer in your head, then open the answer. Ranger’s Device Doctor has 653 questions like these for Apple Device Support, with mock exams.

Question 1Kibble & Co. enrolled previously deployed company iPhones with account-driven Device Enrollment. The MDM administrator now finds that Managed Lost Mode and Activation Lock management are unavailable for them. What explains this?

  1. Those features need Automated Device Enrollment
  2. The iPhones need a newer version of iOS
  3. Those features need a personal Apple Account on the device
  4. The administrator lacks the Manager role in Apple Business
Show the answer

Answer: A. Those features need Automated Device Enrollment

Account-driven Device Enrollment cannot turn on Managed Lost Mode or manage Activation Lock on iPhone; those need Automated Device Enrollment, which supervises the device.

Question 2A company iPhone returned by a former driver is Activation Locked to Kibble & Co. through the MDM service. How can IT get past the lock?

  1. Restore the iPhone in recovery mode with a Mac
  2. Enter the bypass code from the MDM service
  3. Remove the SIM card and restart
  4. Set it up as new without Wi-Fi
Show the answer

Answer: B. Enter the bypass code from the MDM service

For organization-linked Activation Lock, enter the bypass code from the device management service, or an administrator with Manage Devices rights in Apple Business or Apple School Manager can turn the lock off.

Question 3Mr. Barkley tries to erase his personal iPad before giving it to his niece, and the iPad asks for his Apple Account password. Why?

  1. Find My is on; signing out removes Activation Lock
  2. The iPad needs it to download iPadOS
  3. The iPad must make a final backup to iCloud
  4. It is required to keep his apps after the erase is done
Show the answer

Answer: A. Find My is on; signing out removes Activation Lock

With Find My on, the user must sign out of the Apple Account before the erase can proceed, which removes Activation Lock so the next owner can set up the iPad.

Question 4A user turns on Stolen Device Protection. Which two statements describe what it adds when the iPhone is away from familiar locations? Choose two.

  1. Some actions need Face ID or Touch ID, with no passcode fallback
  2. Changing the Apple Account password adds a security delay
  3. The iPhone can no longer be unlocked with the passcode
  4. Lockdown Mode turns on automatically
  5. It works only with a Managed Apple Account
Show the answer

Answers: A. Some actions need Face ID or Touch ID, with no passcode fallback, B. Changing the Apple Account password adds a security delay

Away from familiar locations, Stolen Device Protection requires biometrics for sensitive actions, such as using saved passwords, and adds a security delay before changes like the Apple Account password.

Question 5On a Mac with Apple silicon, user data is already encrypted. What does turning on FileVault add?

  1. It encrypts iCloud Drive
  2. It replaces the need for a login password
  3. A login password is needed to decrypt data, even with the Mac in hand
  4. It stops every app, even ones the user opens, from reading the user's files
Show the answer

Answer: C. A login password is needed to decrypt data, even with the Mac in hand

On a Mac with Apple silicon, user data is encrypted automatically. FileVault adds a layer: a login password is required to decrypt the data, even if someone has physical access to the Mac.

Practice it in Ranger’s Device DoctorThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

Apple, iPhone, iPad and Mac are trademarks of Apple Inc. Ranger Gamez is not affiliated with or endorsed by Apple. The practice questions are written to the published exam objectives; they are not real exam questions.