Lesson 12: Manage FileVault

Question 1

How does FileVault protect user data?

Answer 1

FileVault encrypts the startup volume to protect user data.

Question 2

What are the differences between full-system encryption and full-disk encryption?

Answer 2

The difference between full-system encryption and full-disk encryption and the FileVault requirements for each are listed below:

• Full-System Encryption:
  Used in Mac computers with a T2 Security Chip
  Full-system encryption is automatic and integrates the function of several controllers that Mac computers use.

In this case, FileVault should be turned on for additional security. (Without FileVault enabled, the Mac’s encrypted SSDs will automatically mount and decrypt when connected to your Mac.)
* Full-Disk Encryption:
Used in Mac computers without a T2 Security Chip
FileVault uses full-disk encryption to help prevent unauthorized access to the information on your startup disk.

FileVault performs the encryption at the file system driver level of macOS.

Question 3

How can you turn on FileVault if you didn’t turn it on when prompted by Setup Assistant?

Answer 3

You can turn on FileVault at any time from Security & Privacy preferences.

Question 4

What are the two ways you can save the FileVault recovery key when you enable FileVault in Security & Privacy preferences?

Answer 4

FileVault Recovery offers two ways to recover passwords if FileVault passwords are lost:

1. Use your Apple ID to unlock the FileVault volume and reset your password. (This action generates a random FileVault recovery key and saves it to your iCloud account on Apple servers.)
2. Record the key that FileVault randomly generates. (You must keep the key letters and numbers somewhere safe and not on your encrypted startup disk.)