A user reports that their Mac was compromised and the attacker may have created a new account. During triage, you need to quickly identify any recently created user accounts and their home directories. Which command or file would provide the most direct evidence of account creation timestamps and home directory paths?

Run `dscl . -list /Users` and compare the output to a known baseline.

Read the plist files in `/Library/Preferences` for each user.

Run `dscl . -read /Users/ ` for each account and inspect the `dsAttrTypeNative:creationdate` and `NFSHomeDirectory` attributes.

Check `/var/db/dslocal/nodes/Default/users` for plist files with the `generateduid` key.

You are responding to an incident where a macOS system was used to perform a port scan of the internal network. The system has since been rebooted. Which of the following artifacts would provide the best evidence of the scanning activity?

The network flow logs from the organization's firewall or router

The unified log entries for the scanning tool

You are examining a macOS system and need to find the user's network configuration preferences, such as which Wi-Fi networks they have joined. Which directory or file should you examine?

/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist

/Users/username/Library/Preferences/com.apple.wifi.plist

During a forensic examination, you need to find evidence of a user's recently accessed files and folders. Which file or database would provide the most direct evidence of recently opened documents?

`~/Library/Application Support/com.apple.sharedfilelist/`

`~/Library/Preferences/com.apple.finder.plist`

`~/Library/Keychains/login.keychain-db`

`/Library/Logs/DiagnosticReports/`

What is the primary purpose of the keychain in macOS?

To store the user's email messages

To securely store passwords, keys, and certificates

To store the user's calendar events

To store the user's browser history

GIAC Enterprise Incident Responder

Domain 5Objective 1

macOS Essentials GEIR Practice Questions (Page 3)

Part of the macOS Forensics domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 5–9 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 11–15

11application · medium
A user reports that their Mac was compromised and the attacker may have created a new account. During triage, you need to quickly identify any recently created user accounts and their home directories. Which command or file would provide the most direct evidence of account creation timestamps and home directory paths?
Select an answer first
12expert · hard
You are responding to an incident where a macOS system was used to perform a port scan of the internal network. The system has since been rebooted. Which of the following artifacts would provide the best evidence of the scanning activity?
Select an answer first
13application · medium
You are examining a macOS system and need to find the user's network configuration preferences, such as which Wi-Fi networks they have joined. Which directory or file should you examine?
Select an answer first
14application · medium
During a forensic examination, you need to find evidence of a user's recently accessed files and folders. Which file or database would provide the most direct evidence of recently opened documents?
Select an answer first
15foundation · easy
What is the primary purpose of the keychain in macOS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.