An examiner wants to correlate an Apple Watch user's workout activity with their iPhone's Screen Time data to see if the user was active during times when the phone was locked. Which data set from the Watch would be most useful?

The Watch's Screen Time settings.

The Watch's notification history.

The Watch's workout route and heart rate data.

During a forensic examination of a macOS device, you locate the Contacts database and the Notes database for the user. You need to correlate phone numbers found in Contacts with phone numbers mentioned in Notes. Which approach best preserves the integrity of the original data while allowing efficient cross-referencing?

Use the Contacts app's search feature to look up each phone number from Notes manually.

Query the live Contacts and Notes databases directly using the user's account while the device is running.

Export the Contacts database to a CSV file and the Notes database to a text file, then compare the exports.

Copy both database files to an evidence drive and run read-only queries against the copies.

GIAC iOS and macOS Examiner

Domain 3Objective 1

Apple Application Analysis GIME Practice Questions (Page 1)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 1–5

1foundation · easy
When examining the iOS Photos library, which table in Photos.sqlite is used to store additional asset metadata such as camera make/model, lens, and orientation?
Select an answer first
2foundation · easy
Inside a Wallet .pkpass bundle, which file contains the core pass data such as the pass type identifier, serial number, and barcode message?
Select an answer first
3application · medium
An examiner wants to correlate an Apple Watch user's workout activity with their iPhone's Screen Time data to see if the user was active during times when the phone was locked. Which data set from the Watch would be most useful?
Select an answer first
4application · medium
During a forensic examination of a macOS device, you locate the Contacts database and the Notes database for the user. You need to correlate phone numbers found in Contacts with phone numbers mentioned in Notes. Which approach best preserves the integrity of the original data while allowing efficient cross-referencing?
Select an answer first
5foundation · easy
In the iOS Notes app's SQLite database, which field within the ZICNOTEDATA table holds the serialized note content that must be parsed to recover the note's text?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Apple Application Analysis GIME Practice Questions (Page 1)

Questions 1–5

When examining the iOS Photos library, which table in Photos.sqlite is used to store additional asset metadata such as camera make/model, lens, and orientation?

Inside a Wallet .pkpass bundle, which file contains the core pass data such as the pass type identifier, serial number, and barcode message?

An examiner wants to correlate an Apple Watch user's workout activity with their iPhone's Screen Time data to see if the user was active during times when the phone was locked. Which data set from the Watch would be most useful?

In the iOS Notes app's SQLite database, which field within the ZICNOTEDATA table holds the serialized note content that must be parsed to recover the note's text?

Keep studying — Application and Data Analysis