During an investigation, you need to determine if a user's keychain contains any saved internet passwords that could be relevant to the incident. Which file should you examine?

/Library/Keychains/System.keychain

/Users/username/Library/Safari/Passwords.plist

/Users/username/Library/Keychains/login.keychain-db

/Users/username/Library/Preferences/com.apple.internet.plist

A forensic analyst is examining a Mac and needs to determine which users have administrative privileges and whether any hidden accounts exist. Which command would provide a comprehensive list of local users along with their UID and group memberships?

`dscl . -list /Users UniqueID` and `dscl . -read /Groups/admin GroupMembership`

GIAC Enterprise Incident Responder

Domain 5Objective 1

macOS Essentials GEIR Practice Questions (Page 7)

Part of the macOS Forensics domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 5–9 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

Questions 31–33

31foundation · easy
What is the primary logging system in modern macOS versions (10.12 and later)?
Select an answer first
32application · medium
During an investigation, you need to determine if a user's keychain contains any saved internet passwords that could be relevant to the incident. Which file should you examine?
Select an answer first
33application · medium
A forensic analyst is examining a Mac and needs to determine which users have administrative privileges and whether any hidden accounts exist. Which command would provide a comprehensive list of local users along with their UID and group memberships?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

macOS Essentials GEIR Practice Questions (Page 7)

Questions 31–33

What is the primary logging system in modern macOS versions (10.12 and later)?

During an investigation, you need to determine if a user's keychain contains any saved internet passwords that could be relevant to the incident. Which file should you examine?

A forensic analyst is examining a Mac and needs to determine which users have administrative privileges and whether any hidden accounts exist. Which command would provide a comprehensive list of local users along with their UID and group memberships?

Keep studying — macOS Forensics