CompTIA A+ · Operating Systems
macOS from a technician's perspective — installing and removing applications, the five system folders, built-in security tools, System Settings, key macOS features, and the tools a technician reaches for when something goes wrong.
30 min read · macOS Features & Tools
// CHECK YOUR KNOWLEDGE
macOS runs exclusively on Apple hardware — both Intel-based Macs and Apple Silicon (-based) Macs introduced in 2020. It is a Unix-based operating system, descended from BSD Unix, which gives it a fundamentally different architecture from Windows. A technician supporting a mixed environment needs macOS literacy on its own terms: the structure, the application model, the built-in security tools, and the utilities for diagnosing and recovering from problems are all distinct from their Windows counterparts.
macOS uses three distinct file formats for software distribution. Understanding each is essential because the installation process differs for each one.
.dmg — Disk Image
A .dmg file is a disk image: a virtual disk that macOS mounts when you open it. The mounted image typically contains the application bundle (a .app file) and a shortcut to the /Applications folder. Installation means dragging the .app into /Applications — no installer wizard, no entries, no system-wide configuration files written outside the app bundle. When installation is complete, eject the disk image (the mounted volume, not the .dmg file itself) from 's sidebar.
.pkg — Installer Package
A .pkg file runs a guided installation wizard, similar in concept to a Windows .msi installer. Use .pkg when an application needs to place components in specific system locations, load kernel extensions, create LaunchDaemons, or perform setup steps that a simple drag-and-drop cannot accomplish. macOS displays an installer dialog with license agreement, destination, and progress screens. Administrative credentials are typically required.
.app — Application Bundle
A .app is not actually a single file — it is a folder that macOS displays as a single icon. Inside the bundle are the application's executable, resources, frameworks, and metadata, organized in a defined directory structure. The "installation" of a .app-only distribution is simply copying the bundle to /Applications. The entire application lives inside this one folder.
▸ EXAM TIP
macOS application file types — the A+ distinction:
| Format | What it is | How to install | When used |
|--------|-----------|---------------|-----------|
| .dmg | Disk image | Mount → drag .app to /Applications → eject | Most third-party apps |
| .pkg | Installer package | Run wizard (like Windows .msi) | Apps needing system components |
| .app | Application bundle | Copy to /Applications | Simple apps, already extracted |
The exam may describe an installation scenario and ask which file format applies. .dmg mounts as a virtual disk; .pkg runs an installer wizard; .app is a self-contained folder.
App Store
The Mac App Store is Apple's official distribution channel. Apps installed through the App Store are sandboxed — they operate with restricted access to system resources and other applications' data. The App Store handles updates automatically through the App Store app or through Software Update in System Settings. An is required to download App Store apps.
Uninstalling Applications
For most apps — particularly those distributed as .dmg or .app — uninstalling means dragging the .app bundle from /Applications to Trash and emptying the Trash. macOS does not use a central application registry the way Windows does, so no "uninstall" utility is needed for simple apps. Some applications, especially those installed via .pkg, ship with a dedicated uninstaller or require manual removal of additional components. Preference files and caches belonging to the removed app may remain in ~/Library/Preferences and ~/Library/Caches after deletion — flag visibility and cleanup behavior for verification. Dedicated third-party tools can find and remove these remnants.
macOS organizes its file system with five root-level directories a technician must know. These are not the only folders at the root level, but they are the ones the A+ exam tests.
/Applications — Where installed applications live. Apps placed here are available to all users on the machine. Both App Store and third-party apps live here after installation.
/Users — Contains a home directory folder for each user account on the Mac (e.g., /Users/alice, /Users/bob). Each user's home directory is their private space: Desktop, Documents, Downloads, Movies, Music, Pictures, and their personal Library folder all live under /Users/username/.
/Library — System-wide library directory containing support files shared across all users: fonts installed for all users, application support files, frameworks, and system-level preference files. This is distinct from the per-user Library inside each home directory.
/System — Contains the core macOS operating system files. System Integrity Protection (SIP) prevents modification of this directory — even the root user cannot write to /System while SIP is active. Technicians should never need to modify files here; doing so requires disabling SIP, which removes an important security boundary — flag SIP for verification.
/Users/[username]/Library (also written as ~/Library) — Each user's personal library directory, separate from the system-wide /Library. Stores that user's application preferences, caches, saved application state, and personal application support files. This folder is hidden in Finder by default — flag hidden behavior for verification. To access it: in Finder, hold Option while clicking the Go menu and select Library, or type ~/Library into the Go → Go to Folder dialog.
▸ EXAM TIP
The five macOS system folders — paths and purposes:
| Path | What lives here |
|------|----------------|
| /Applications | Installed apps (all users) |
| /Users | User home directories |
| /Library | System-wide fonts, app support, preferences (all users) |
| /System | Core OS files — protected by SIP; do not modify |
| ~/Library (/Users/[name]/Library) | Per-user preferences, caches, app support — hidden in Finder |
Exam pattern: a scenario describes a file location (e.g., "the user's personal application preferences") and asks which folder it belongs in. /Library = system-wide; ~/Library = per-user. This distinction is the most common source of confusion.
An Apple ID is the account that ties a Mac to Apple's ecosystem. It is required for App Store purchases and downloads, services (Drive, iMessage, FaceTime, sync), and Apple's activation and ownership systems. On a corporate Mac, the Apple ID situation depends on whether the machine is personally owned or managed.
Corporate restrictions via (Mobile Device Management): Organizations managing Mac fleets use MDM to enforce policies — restricting App Store access, requiring specific security configurations, remotely wiping devices, and deploying corporate apps without the App Store. You covered MDM concepts in the Core 1 Mobile module; the mechanism is the same on macOS. Corporate Macs enrolled in MDM may have a different Apple ID policy than personal devices, or no personal Apple ID at all, depending on organizational policy.
macOS includes two distinct built-in security mechanisms for protecting against malicious software:
— Enforces a policy on which applications macOS will allow to run based on their source and digital signature. When you try to open a downloaded application, Gatekeeper checks: is it from the App Store? Is it signed by a registered Apple developer and notarized by Apple? If neither condition is met, Gatekeeper blocks the app and displays a dialog. Gatekeeper is a preventive gate at application launch time — it evaluates trust before execution.
— Apple's built-in signature scanner. XProtect maintains a database of known malware signatures and scans files at download time and when apps are launched. It runs silently in the background. Apple updates XProtect's signature database independently of major updates, so the malware definitions stay current without requiring the user to install a full macOS update. XProtect is reactive detection — it catches known threats after they arrive.
▸ EXAM TIP
Gatekeeper vs XProtect — two different functions:
Scenario pattern: a user downloads a third-party app and macOS blocks it with a dialog saying the app is from an unidentified developer — that is Gatekeeper. If macOS quietly quarantines a downloaded file that matches a known malware signature, that is XProtect.
is macOS's built-in backup system. It performs automatic hourly, daily, and weekly backups to an external drive or network-attached storage. Backups are incremental — only changed files are copied after the first full backup. From Time Machine, users can restore individual files or return the system to an earlier state. Configure Time Machine in System Settings → General → Time Machine.
▸ NOTE
Time Machine backup frequency: Time Machine backs up hourly for the past 24 hours, daily for the past month, and weekly for all previous months, keeping as many backups as the destination drive can hold. When the drive fills up, Time Machine automatically deletes the oldest backups to make room for new ones.
Software updates are delivered through System Settings → General → Software Update. macOS delivers full OS updates (including feature releases and security patches) through this path.
Rapid Security Response () is a mechanism Apple introduced to deliver urgent security patches faster than a full macOS update cycle. An RSR is a small, targeted fix for a specific active vulnerability — a exploit or a critical flaw that cannot wait for the next scheduled full update. RSR updates install faster than a full macOS update and typically require only a brief restart — much shorter than the reboot needed for a complete system update. They appear separately from standard macOS updates in Software Update — flag the exact RSR mechanism for verification.
The central configuration panel for macOS has been called System Preferences since Mac OS X. Starting with macOS Ventura (2022), Apple renamed and redesigned it as System Settings, adopting an interface similar to the iOS Settings app — flag this rename and version for verification. The A+ exam may use either name; know that both refer to the same panel depending on the macOS version.
Key panes a technician configures:
Displays — Screen resolution, arrangement when multiple monitors are connected, brightness, Night Shift (blue light reduction), and True Tone (color temperature adaptation). On multi-monitor setups, this is where the primary display and monitor positions are configured.
Network — Wi-Fi connection management, Ethernet configuration, setup, and network service order. The macOS equivalent of Windows' network adapter settings.
Printers & Scanners — Add, remove, and manage printers and scanners. Set the default printer. macOS uses CUPS (Common Unix Printing System) underneath; from a user perspective, the pane functions similarly to Windows' Devices and Printers.
Privacy & Security — Per-app permissions for camera, microphone, location, contacts, and calendar. Also contains Gatekeeper's allowed source settings (App Store only vs App Store and identified developers) and status. In macOS Ventura and later, this pane also surfaces SIP status and security policy settings.
Accessibility — Vision aids (display zoom, VoiceOver screen reader, color filters), hearing aids (visual alerts for sounds), and motor/interaction aids (Sticky Keys, Slow Keys, pointer control).
Time Machine — Configure the backup destination, enable or disable automatic backups, and view backup history.
Spaces (Multiple Desktops) — macOS supports multiple independent virtual desktops called Spaces. Each Space can contain different open windows and applications. Users switch between Spaces by swiping with three or four fingers on the trackpad, or through . Applications can be assigned to specific Spaces so they always open on the same desktop.
Mission Control — An overview mode that displays all open windows, full-screen apps, and desktop Spaces at once. Activate with the F3 key, a three-finger swipe up on the trackpad, or Control+Up Arrow. From Mission Control, create new Spaces, drag windows between Spaces, and quickly switch to any open window or Space.
Keychain — macOS's built-in . Keychain stores saved passwords for websites and apps, Wi-Fi network credentials, certificates, and secure notes, all encrypted and protected by the user's login password. iCloud Keychain extends this by syncing saved passwords and credentials across all Apple devices signed in to the same Apple ID.
▸ EXAM TIP
Keychain = macOS built-in password manager. Keychain stores website passwords, app credentials, Wi-Fi passwords, and certificates. iCloud Keychain syncs them across Apple devices. This is a native macOS feature — not a third-party tool.
— System-wide search launched with Cmd+Space. Spotlight searches across files, applications, emails, calendar events, contacts, web results, definitions, and can perform calculations and unit conversions directly from the search bar. For a technician, Spotlight is the fastest way to launch an application or find a file without navigating the folder structure.
iCloud — Apple's cloud services platform. Key components:
Continuity — A collection of features that connect a Mac with nearby Apple devices, particularly iPhone and iPad:
Gestures — The macOS trackpad supports multi-finger gestures for system navigation: two-finger scroll, pinch-to-zoom, three-finger swipe up (Mission Control), three-finger swipe left/right (switch between Spaces), and two-finger swipe left/right (navigate forward/back in apps). External Magic Trackpad and built-in trackpads support the full gesture set; a standard mouse does not.
Finder — The macOS file manager, providing a graphical interface to the file system. Finder launches at login and cannot be quit — it is always running. The Finder toolbar, sidebar, and view options (icon, list, column, gallery) are configurable. Finder handles external drive management, network connection browsing, and file operations (copy, move, rename, delete).
Dock — The persistent bar of app icons at the bottom of the screen (by default). The Dock provides quick launch for frequently used apps, shows running apps (indicated by a dot beneath the icon), and houses the Trash. The Dock can be repositioned to the left or right side of the screen, set to auto-hide, or resized.
Disk Utility — The macOS graphical tool for managing storage. Disk Utility can partition and format drives, create and restore disk images (.dmg files), merge volumes into a set, and repair disk errors. The First Aid feature checks a volume for errors and repairs directory structure problems — flag First Aid name and function for verification. First Aid is the macOS equivalent in function to running chkdsk on Windows, though it operates on and HFS+ volumes.
FileVault — macOS's full-disk encryption feature. When enabled, FileVault encrypts the entire startup disk. The encryption key is tied to the user's login password; without it, the data on the drive is inaccessible. Enable FileVault in System Settings → Privacy & Security → FileVault. The Security module covers encryption concepts in depth — this lesson notes FileVault's existence and location.
▸ EXAM TIP
FileVault = full-disk encryption for macOS. A lost or stolen Mac with FileVault enabled has its data protected — an attacker who removes the drive cannot read the encrypted contents without the recovery key. Enable via System Settings → Privacy & Security → FileVault.
Terminal — Command-line access to macOS's Unix-based subsystem. Terminal launches a shell — macOS uses zsh (Z Shell) as the default since macOS Catalina (2019); earlier versions used bash — flag shell version and name for verification. Through Terminal, advanced users and administrators can run Unix commands, scripts, and developer tools. The A+ objective acknowledges Terminal exists as a tool; the specific commands are out of scope for Core 2 (they are covered in the Linux lesson and in the Core 1 Networking module for network commands).
Force Quit — When an application stops responding, Cmd+Option+Esc opens the Force Quit Applications dialog, which lists all running applications and highlights any that are not responding. Select the application and click Force Quit to terminate it immediately. Alternatively: click the Apple menu → Force Quit, or right-click the app's Dock icon and select Force Quit.
▸ EXAM TIP
Force Quit keyboard shortcut: Cmd+Option+Esc. This is the macOS path to the Force Quit dialog. An unresponsive application on macOS is terminated through Force Quit — not through Activity Monitor (which is the tool for viewing process resource usage, not the primary force-quit interface for end-user scenarios).
The check questions below test your ability to identify macOS file types, locate files in the correct system folder, distinguish Gatekeeper from XProtect, and apply the right tool to a macOS troubleshooting scenario.
Sign in to check your knowledge and earn XP. Sign in
