Lesson 12: Manage FileVault

Question 1

How does FileVault protect user data?

Answer 1

FileVault encrypts the startup volume to protect user data.

Question 2

What are the differences between full-system encryption and full-disk encryption and the way that FileVault performs with each?

Answer 2

The difference between full-system encryption and full-disk encryption and the FileVault requirements include:

Full-System Encryption: Used in Mac computers with a T2 chip

Full-system encryption is automatic and integrates the function of several controllers that other Mac computers use.

In this case, FileVault should be turned on for additional security, because without FileVault enabled, your encrypted SSDs will automatically mount and decrypt when connected to your Mac.

Full-Disk Encryption: Used in Mac computers without a T2 chip

FileVault uses full-disk encryption to help prevent unauthorized access to the information on your startup disk.

FileVault performs the encryption at the file system driver level of macOS.

Question 3

How can you turn on FileVault if you didn’t turn it on when you were prompted by Setup Assistant?

Answer 3

You can turn on FileVault at any time from Security & Privacy preferences.

Question 4

What are the two ways you can save the FileVault recovery key when you enable FileVault in Security & Privacy preferences?

Answer 4

FileVault Recovery offers two ways to recover passwords if FileVault passwords are lost:

1. Use your Apple ID to unlock the FileVault volume and reset your password. This generates a random FileVault recovery key and saves it to your iCloud account on Apple servers.
2. Record the key that FileVault randomly generates. You must keep the key letters and numbers somewhere safe and not on your encrypted startup disk.