A Mac has a LaunchAgent that runs a script every time the user logs in. The script has been modified to include malicious commands. You need to determine when the script was last modified and whether it was executed. Which files would you examine?

The LaunchAgent plist and the script file's modification time.

The script file's access time and the LaunchAgent plist.

The unified log for the script's execution and the script file's modification time.

The LaunchAgent plist and the user's login history.

You are responding to an incident on a macOS system and need to gather network configuration evidence, including the DNS servers the system is using. Which command provides this information?

defaults read /Library/Preferences/SystemConfiguration/preferences.plist

You are investigating a Mac where a malicious LaunchAgent was installed. You need to determine when the agent was loaded and whether it has executed recently. Which log source would provide the most direct evidence?

The `at` command's log at `/var/log/at.log`

The unified log, using `log show --predicate 'process == "launchd"'`

The plist file's `LastExitStatus` key

The system log at `/var/log/system.log`

In macOS, what is the significance of the user's home directory?

It stores all user-specific files, preferences, and application data

It is where all applications are installed

It contains the operating system kernel

It is the default location for all system logs

GIAC Enterprise Incident Responder

Domain 5Objective 1

macOS Essentials GEIR Practice Questions (Page 6)

Part of the macOS Forensics domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 5–9 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 26–30

26expert · medium
A Mac has a LaunchAgent that runs a script every time the user logs in. The script has been modified to include malicious commands. You need to determine when the script was last modified and whether it was executed. Which files would you examine?
Select an answer first
27application · medium
You are responding to an incident on a macOS system and need to gather network configuration evidence, including the DNS servers the system is using. Which command provides this information?
Select an answer first
28application · medium
You are investigating a Mac where a malicious LaunchAgent was installed. You need to determine when the agent was loaded and whether it has executed recently. Which log source would provide the most direct evidence?
Select an answer first
29foundation · easy
Which command-line tool is used to query the unified logging system in macOS?
Select an answer first
30foundation · easy
In macOS, what is the significance of the user's home directory?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.