macOS DFIR Fundamentals GEIR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An incident responder is examining a macOS system and needs to find the home directory of a specific user account. Which command or file will provide this information?

   • AThe `ls -la /Users` command
   • BThe `dscl . -read /Users/username NFSHomeDirectory` command
   • CThe `id username` command
   • DThe `cat /etc/passwd` command
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which macOS directory contains the user account database and is a key location for examining local user accounts?

   • A/Users
   • B/Library/Accounts
   • C/var/db/dslocal
   • D/etc/passwd
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst needs to determine whether a specific application was launched on a macOS system and, if so, when. The application is not a standard Apple app. Which approach provides the most reliable evidence?

   • ACheck the application's last opened date in Finder
   • BExamine the application's code signature timestamp
   • CReview the system's sleep/wake logs
   • DSearch unified logs for process execution events containing the application name
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is investigating a macOS system and needs to determine if a specific process was running at a particular time in the past. Which command should the analyst use to query the unified log for process execution events?

   • A`last | grep ProcessName`
   • B`cat /var/log/process.log`
   • C`log show --start "2024-01-01 10:00:00" --end "2024-01-01 10:15:00" --predicate 'process == "ProcessName"'`
   • D`ps -ef | grep ProcessName`
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst needs to review authentication failures on a macOS system to identify a brute-force attack. Which command or tool provides the most direct access to this information?

   • Alast -f /var/log/wtmp
   • Bdmesg | grep -i 'auth'
   • Clog show --predicate 'subsystem == "com.apple.Authorization"'
   • Dcat /var/log/authd.log
   Reveal Solution Discussion Select an answer first