What is the role of System Integrity Protection (SIP) in macOS?

It verifies the digital signature of downloaded applications

It controls which apps can access the camera and microphone

It protects system files and processes from modification by unauthorized users or software

During a forensic acquisition of a Mac, you find that the user's home directory is encrypted with FileVault. You have the user's password. What is the most appropriate way to acquire the user's data while preserving the integrity of the encrypted volume?

Disable FileVault in System Settings, then reboot and image the volume.

Log in as the user and copy the files to an external drive.

Use a forensic tool that supports FileVault decryption, such as `fdesetup` or a commercial imager, to create a logical image of the decrypted volume.

Boot the Mac into Recovery Mode and use the Disk Utility to create an image of the encrypted volume.

You are analyzing a macOS system and need to find evidence of applications that launched at login. Which file or directory should you examine?

/Users/username/Library/LaunchAgents

GIAC Enterprise Incident Responder

Domain 5Objective 1

macOS Essentials GEIR Practice Questions (Page 1)

Part of the macOS Forensics domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 5–9 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 1–5

1foundation · easy
What is the role of System Integrity Protection (SIP) in macOS?
Select an answer first
2application · medium
During a forensic acquisition of a Mac, you find that the user's home directory is encrypted with FileVault. You have the user's password. What is the most appropriate way to acquire the user's data while preserving the integrity of the encrypted volume?
Select an answer first
3application · medium
An incident responder needs to capture the current network configuration of a Mac that is suspected of using a rogue DHCP server. Which command would show the IP address, subnet mask, router, and DHCP server address in a single output?
Select an answer first
4foundation · easy
Which command-line tool is used to display and manipulate network interfaces in macOS?
Select an answer first
5application · medium
You are analyzing a macOS system and need to find evidence of applications that launched at login. Which file or directory should you examine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

macOS Essentials GEIR Practice Questions (Page 1)

Questions 1–5

What is the role of System Integrity Protection (SIP) in macOS?

During a forensic acquisition of a Mac, you find that the user's home directory is encrypted with FileVault. You have the user's password. What is the most appropriate way to acquire the user's data while preserving the integrity of the encrypted volume?

An incident responder needs to capture the current network configuration of a Mac that is suspected of using a rogue DHCP server. Which command would show the IP address, subnet mask, router, and DHCP server address in a single output?

Which command-line tool is used to display and manipulate network interfaces in macOS?

You are analyzing a macOS system and need to find evidence of applications that launched at login. Which file or directory should you examine?

Keep studying — macOS Forensics