You need to review the unified log on a macOS system for events related to a specific process name 'malware' that occurred in the last hour. Which command should you use?

log stream --predicate 'process == "malware"'

grep malware /var/log/system.log

log show --predicate 'process == "malware"' --last 1h

What is the primary purpose of FileVault on macOS?

To encrypt the entire system volume

To protect the system from unauthorized kernel extensions

To control app access to user data

To block unsigned applications from running

An incident responder is investigating a Mac that may have been used to access a malicious IP address. The Mac's network configuration was changed after the incident, and the current IP address is different. The responder needs to determine the IP address that was in use at the time of the incident. Which approach would be most reliable?

Use `netstat -rn` to view the current routing table.

Check the DHCP lease history in `/var/db/dhcpclient/leases/`.

Query the unified log for network configuration events at the time of the incident.

Examine the ARP cache from the router's logs.

GIAC Enterprise Incident Responder

Domain 5Objective 1

macOS Essentials GEIR Practice Questions (Page 4)

Part of the macOS Forensics domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 5–9 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 16–20

16application · medium
You need to review the unified log on a macOS system for events related to a specific process name 'malware' that occurred in the last hour. Which command should you use?
Select an answer first
17foundation · easy
Which command-line tool is commonly used to read and convert property list files in macOS?
Select an answer first
18foundation · easy
What is the primary purpose of FileVault on macOS?
Select an answer first
19expert · hard
An incident responder is investigating a Mac that may have been used to access a malicious IP address. The Mac's network configuration was changed after the incident, and the current IP address is different. The responder needs to determine the IP address that was in use at the time of the incident. Which approach would be most reliable?
Select an answer first
20foundation · easy
Which directory is the standard location for LaunchDaemons that are installed by third-party software?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

macOS Essentials GEIR Practice Questions (Page 4)

Questions 16–20

You need to review the unified log on a macOS system for events related to a specific process name 'malware' that occurred in the last hour. Which command should you use?

Which command-line tool is commonly used to read and convert property list files in macOS?

What is the primary purpose of FileVault on macOS?

Which directory is the standard location for LaunchDaemons that are installed by third-party software?

Keep studying — macOS Forensics