An analyst is investigating a macOS system that may have connected to a malicious Wi-Fi network. The analyst needs to determine the MAC address of the access point the system associated with. Which artifact contains this information?

Unified log entries for Wi-Fi association events

The com.apple.wifi.known-networks.plist

The system's DNS resolver configuration

Which macOS command displays the current DNS cache and can be used to see recently resolved domain names?

dscacheutil -cachedump -entries Host

A forensic analyst needs to determine whether a local user account was created by an attacker or by the legitimate IT team. The system has FileVault enabled and the analyst has admin access. Which artifact provides the most reliable evidence of account creation time?

The FileVault recovery key escrow record

The system's unified log entries for 'user account created'

The account's home directory modification time

The account's plist in /var/db/dslocal/nodes/Default/users/

An incident responder is investigating a macOS system that was used to connect to a suspicious Wi-Fi network. The responder needs to determine the exact time the connection occurred. The system is currently running and the user is logged in. Which artifact would provide the most reliable evidence?

The Wi-Fi connection log in the unified log

GIAC Enterprise Incident Responder

Domain 5Objective 2

macOS DFIR Fundamentals GEIR Practice Questions (Page 5)

Part of the macOS Forensics domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 5–9 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

8concepts

Questions 21–25

21application · easy
A forensic examiner needs to determine which groups a specific user account belongs to on a macOS system. The system is currently running and the examiner has admin access. Which command provides this information?
Select an answer first
22application · medium
An analyst is investigating a macOS system that may have connected to a malicious Wi-Fi network. The analyst needs to determine the MAC address of the access point the system associated with. Which artifact contains this information?
Select an answer first
23foundation · easy
Which macOS command displays the current DNS cache and can be used to see recently resolved domain names?
Select an answer first
24application · medium
A forensic analyst needs to determine whether a local user account was created by an attacker or by the legitimate IT team. The system has FileVault enabled and the analyst has admin access. Which artifact provides the most reliable evidence of account creation time?
Select an answer first
25expert · hard
An incident responder is investigating a macOS system that was used to connect to a suspicious Wi-Fi network. The responder needs to determine the exact time the connection occurred. The system is currently running and the user is logged in. Which artifact would provide the most reliable evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.