IT Support & Help Desk Fundamentals Module 6
macOS and Linux client administration interview questions
Interview questions on macOS and Linux client administration: warm-ups, then what each harder question tests and how a good answer starts.
Warm-up questions
Short questions with short answers, each answered in full.
-
Fresher to mid
What does a Developer ID signature prove about Mac software, and what does notarisation add?
A Developer ID signature proves who made the software and that nobody has altered it since it was signed, because the signing certificate is issued by Apple to an identified developer. Notarisation adds a check of the software itself: the developer submits it, Apple scans it for known malicious content, and when nothing is found Apple issues a ticket, stapled to the software or published online. By default macOS has required notarised software since macOS 10.15, so Gatekeeper's first-open check wants both. spctl --assess -vv shows the result: source=Notarized Developer ID for software that has both. An ad-hoc signature, made with codesign -s -, proves neither, which is why Gatekeeper rejects it.
From the lesson macOS apps, Gatekeeper and software updates
-
Fresher
Why does a Mac with almost no unused memory not prove that it needs more RAM?
Answered in the lesson macOS troubleshooting: Activity Monitor to logs
-
Fresher
What does System Integrity Protection protect, in a sentence a user would understand?
Answered in the lesson macOS security: FileVault, SIP, permissions
-
Fresher
A folder is set with chmod 750. What can its owner, its group and everyone else do with it?
The digits are three sets: 7 for the owner, 5 for the group and 0 for everyone else. 7 is 4 + 2 + 1, so the owner can list the folder, add, rename and delete entries in it, and go into it. 5 is 4 + 1, so members of the folder's group can list the names and go in, and open a file inside when that file's own mode allows it, but they cannot add, rename or delete anything there. 0 gives everyone else nothing: they cannot even list the folder. ls -l prints the same mode as drwxr-x---. Two follow-ups are worth having ready: on a folder, x is what lets someone go in, and a user who should have the group's access needs to be a member of the folder's group, not a second owner.
From the lesson Linux commands every support tech needs
Questions with model answers
What each question tests, the first step of a good answer and the follow-ups to expect.
-
Mid to senior
A new joiner has used a personal Apple Account on their company Mac for six months, with Desktop and Documents stored in iCloud Drive. The organisation now issues Managed Apple Accounts. How do you move their work over without losing it or leaving copies behind?
- What it tests
- Separating personal from work data, planning a move with a backup and the user present, and knowing what signing out of iCloud does to files kept in Desktop and Documents.
- First step
- Find out where the files really are before anything is signed out. With Desktop and Documents in iCloud Drive, the Mac may hold only some of them, and signing out offers to keep a local copy or not. Agree with the user which files are work files, and make a backup of those that the organisation holds before any account changes.
- Follow-ups
-
- The user does not want to sign out of the personal account at all. What then?
- How do you check that no work file is left in the personal iCloud Drive?
- Work passwords are saved under the personal account. What do you advise?
From the lesson macOS essentials: Settings, Finder, accounts
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
- Pro pass · 1 week₹79$2.99
- 30 days₹179$5.99
- 1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
-
Fresher to mid
A standard user on a company Mac needs an app whose installer asks for an administrator's name and password, and asks you for the admin password. What do you do?
- What it tests
- Keeping administrator credentials private, checking that the organisation allows the app, and using the organisation's own install route rather than raising one person's rights.
- First step
- Decline to share the password and ask what the app is and what the user needs it for. Then check the organisation's own install route: an app catalogue or self-service portal from device management, or the team that decides which software staff may use.
- Follow-ups
-
- The app is allowed but not in the catalogue. What do you do?
- The user says a previous technician typed the password for them. Does that change anything?
- How does a managed administrator account help here?
From the lesson macOS essentials: Settings, Finder, accounts
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
A vendor's setup guide tells staff to paste curl -fsSL https://example.com/install.sh | sudo sh into Terminal to install its agent on 25 company Macs. What do you check, and how do you get the agent installed safely?
- What it tests
- Seeing that a piped script skips Gatekeeper's first-open checks, reading before running, preferring a signed, notarised package, and deploying it once through device management instead of 25 times by hand.
- First step
- Do not run it. Download the script to a file on a test Mac and read what it does: what it fetches, from which addresses, what it installs and where, and what it changes. Then ask the vendor whether a signed, notarised installer package of the agent exists.
- Follow-ups
-
- The vendor has no package, only the script. What then?
- Why is sudo in the pasted line the biggest risk?
- How do you check the agent after it is installed?
From the lesson macOS apps, Gatekeeper and software updates
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
On 12 of your 60 Apple silicon Macs the finance team uses an accounting app built for Intel only, and the organisation plans to move to macOS 28 next year. How do you plan for it?
- What it tests
- Turning Apple's Rosetta deadline into a dated plan: an inventory, the vendor's roadmap, a tested replacement, and a gate on the upgrade for the Macs that still depend on the app.
- First step
- Confirm the inventory before anything else: on each Mac, read the app's Kind in Get Info or its architectures with lipo -archs, and list any Intel-only plug-ins it loads. Then ask the vendor whether a Universal or Apple silicon version exists or is planned, and when.
- Follow-ups
-
- The vendor has no Apple silicon version planned. What are your options?
- How do you stop those 12 Macs from upgrading too early?
- How do you test the new version before the finance team relies on it?
From the lesson macOS apps, Gatekeeper and software updates
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Fresher to mid
A user says their MacBook is fine every morning and slow every afternoon from about 3 o'clock, with no warning messages. How do you find the cause?
- What it tests
- Turning a vague, repeating complaint into measurements at the right time: Activity Monitor during the slow period, memory pressure over the day, and the log for the minutes the slowness starts.
- First step
- Measure while it is slow, not in the morning. Ask the user to note the exact time it starts tomorrow, and have Activity Monitor open then: the CPU tab sorted by % CPU, the Memory tab's pressure graph, and the Energy tab. A pattern that repeats at the same time usually has a schedule behind it.
- Follow-ups
-
- Activity Monitor shows nothing unusual at 3 o'clock. What next?
- The busy process is a backup or sync client. What do you change?
- Memory pressure turns red every afternoon. What do you check before asking for RAM?
From the lesson macOS troubleshooting: Activity Monitor to logs
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
An accounting app's vendor asks for a sysdiagnose from a finance user's Mac to investigate a crash. What do you do before anything is sent?
- What it tests
- Knowing what a sysdiagnose contains, getting the user's consent and the organisation's rules, sending a smaller report when it answers, and using the agreed channel instead of email.
- First step
- Ask the vendor what they need to see, because a crash report or a log window may answer it. Then tell the user what a sysdiagnose collects, from recent system logs to network status and crash reports, and check the organisation's rules for sharing such data with a vendor before anyone creates it.
- Follow-ups
-
- The vendor insists on the full archive. How do you send it?
- The user is away. Can you create it without them?
- What smaller evidence could you offer first?
From the lesson macOS troubleshooting: Activity Monitor to logs
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Mid to senior
A department manager asks you to switch off Gatekeeper and FileVault on their team's Macs, because a reporting tool they bought will not open. What do you do?
- What it tests
- Refusing to remove protections as a fix, finding why the tool is refused, getting a version or a narrow exception that keeps every protection on, and explaining the risk in business terms.
- First step
- Find out exactly what fails: on one Mac, ask Gatekeeper for its verdict on the tool with spctl --assess -vv and note the message the user sees. FileVault rarely stops an app from opening, so ask what the manager believes it blocks before treating it as part of the problem.
- Follow-ups
-
- The vendor has no notarised version. What are the options?
- The manager says they accept the risk. Does that change your answer?
- What would you write in the ticket?
From the lesson macOS security: FileVault, SIP, permissions
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
-
Fresher to mid
An Ubuntu desktop shows "Temporary failure in name resolution" for every website, yet ping 198.51.100.7, a public address the office network lets through, gets replies. How do you find the cause, and what do you change?
- What it tests
- Separating routing from name resolution, reading the servers systemd-resolved really uses instead of trusting /etc/resolv.conf, and fixing DNS where the link gets it rather than on the desktop by hand.
- First step
- Run resolvectl status and read the Current DNS Server and DNS Servers lines of the link that carries the default route. /etc/resolv.conf will usually show only 127.0.0.53, the local stub, so it cannot tell you which server systemd-resolved is asking. Write the servers into the ticket before you test them.
- Follow-ups
-
- resolvectl status lists no DNS servers on any link. What next?
- Names work again as soon as the VPN disconnects. What does that tell you?
- Only one internal name fails while public names resolve. Where do you look?
From the lesson Linux commands every support tech needs
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
-
Mid to senior
A colleague added a USB backup disk to /etc/fstab on an Ubuntu desktop. The next morning, with the disk unplugged, the desktop stops at an emergency-mode prompt. How do you get it starting again, and how should that line have been written?
- What it tests
- Recovering from a bad fstab line without a reinstall: reading the journal for the failed mount, editing safely with a backup, proving the file before a restart, and writing removable disks with a UUID and nofail.
- First step
- At the emergency prompt, read why the start stopped with journalctl -xb and find the mount that failed. Then copy /etc/fstab before you change anything. The line for the missing disk is the suspect: comment it out rather than deleting it, so the colleague's intent is kept for the fix.
- Follow-ups
-
- The root file system is mounted read-only at the prompt. How do you edit fstab?
- How do you prove the corrected file before you restart?
- Why name the disk by UUID rather than /dev/sdb1?
From the lesson Linux commands every support tech needs
Model answer, Pro.In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
All IT Support & Help Desk Fundamentals interview questions · The IT Support & Help Desk Fundamentals track