When a user cannot log in and has started the Mac in macOS Recovery, Apple provides a password-reset workflow through Terminal. From the Utilities menu, open Terminal, type the command `resetpassword`, and press Return. This launches the Reset Password assistant, where the user can follow the available recovery steps and create a new login password. Therefore, option B is correct; the command is properly written as `resetpassword` without a space. The `passwd` command is not the Apple-documented Recovery workflow for this scenario. Disk Utility is used primarily for storage and file-system tasks, and changing Secure Boot settings does not reset a local user password. The Recovery password assistant is specifically designed to handle forgotten or unusable Mac login passwords when normal sign-in is unavailable.

================

Apple supports two standard manual methods for updating iOS or iPadOS. Directly on the device, open Settings > General > Software Update and download and install the available update, making option B correct. A user can also connect the iPhone or iPad to a trusted Mac running macOS Catalina or later, select the device in Finder, choose General, and select Check for Update, making option C correct. There is no separate iOS or iPadOS Update application, and operating-system updates are not initiated from the App Store. Another iPhone or iPad cannot function as the update host in the manner described in option D. Finder provides the supported computer-based update path when a wireless update is unavailable or when updating through a Mac is preferred.

================

Lockdown Mode is an optional extreme-protection feature designed for users who may face highly sophisticated targeted cyberattacks. To reduce the device’s attack surface, Apple restricts several communications and connectivity features. Incoming FaceTime calls are blocked unless the user previously called that person or contact within the permitted recent period. Therefore, option C is correct. Lockdown Mode also restricts other capabilities such as certain Messages attachments, complex web technologies, incoming Apple service invitations, Shared Albums, device connections, and configuration-profile installation. It does not simply disable Calendar events, the App Store, or normal iCloud Backup as described by the other options. The restrictions intentionally reduce functionality in exchange for stronger protection against advanced exploit chains and targeted spyware.

================

A device management service can configure and enforce FileVault on managed Mac computers, making option C correct. Apple provides FileVault device-management payloads that can enable FileVault, control when users are prompted to activate it, specify deferral behavior, and escrow recovery keys to the organization’s management service. FileVault encrypts the Mac startup volume and protects stored data from unauthorized access. Recovery keys are generally escrowed to the device management service rather than to an individual user’s iCloud account. Modern Apple silicon security also does not rely on administrators remotely configuring traditional firmware passwords in the manner described in option B. Likewise, FileVault does not encrypt the disk using an organization signing certificate. The supported administrative security capability among the choices is enabling and managing FileVault.

================

Activation Lock is part of Find My and is designed to deter unauthorized use of an Apple device if it is lost or stolen. When Activation Lock is enabled, the device remains associated with the owner’s Apple Account even after a remote erase. Apple’s activation servers verify the device during activation or recovery, and the associated Apple Account credentials are required before another person can disable Find My, erase the device under normal circumstances, or reactivate and use it. Activation Lock does not simply encrypt all device data, remove Apple Account access, or disable networking. Its primary protective mechanism is maintaining the device-to-account association and requiring authorized credentials before reactivation. This makes option A the correct description of how Activation Lock helps protect Apple devices.

================

Managed Apple Accounts are created, owned, and managed by an organization and are specifically designed to keep organizational information separate from a user’s personal data. Therefore, organization data and documents are associated with the Managed Apple Account, making option D correct. Apple’s account-driven enrollment architecture allows a Managed Apple Account and a personal Apple Account to coexist on supported devices while maintaining separation between work and personal information. Personal photos, personally installed applications, and personal account information remain associated with the unmanaged Apple Account unless specifically deployed or managed by the organization. This separation is particularly important in personally owned device deployments because IT management is limited to organizational accounts, managed applications, settings, and information rather than giving the organization unrestricted access to the user’s personal content.

================

A sysdiagnose captures an extensive collection of system logs and diagnostic information from an iPhone or iPad. Its purpose is to provide detailed technical data that can be examined when researching and troubleshooting operating-system, application, networking, or other complex device issues. Therefore, option A is correct. Sysdiagnose is fundamentally a log-collection mechanism rather than a hardware-management interface. It does not directly manage external hardware, create application-usage tables as its primary function, or perform dedicated hardware testing of components such as memory and logic boards. A sysdiagnose package instead gathers information from numerous system components so that support personnel, administrators, or developers can investigate what occurred around the time a problem was reproduced.

================

Recovered Files folders appear in Trash after a crash or improper shutdown, containing temporary files. Users should check for useful data (e.g., unsaved work) and then empty Trash to free space.

Option A: Not malware-related.

Option C: Preference files aren’t involved.

Option D: Immediate deletion risks data loss.

Rapid Security Response delivers urgent security patches between major updates, enhancing protection without a full OS upgrade.

Option B: Notifications aren’t part of this.

Option C: App downloads aren’t restricted.

Option D: No report is displayed.

Instant Hotspot needs:

A: Same Apple Account for seamless recognition.

B: Wi-Fi and Bluetooth enabled for connectivity.

Option C: Mobile provider isn’t relevant.

Option D: IPv6 isn’t a requirement.