In a fraud investigation, you need to determine if a suspect's iPhone contains a contact that matches a known accomplice, and whether that accomplice's phone number was used to set up a payment pass in Wallet. Which data sources would you analyze?

Notes database for any mention of the accomplice and Photos for their picture.

Apple Watch health data for heart rate during calls and Wallet transaction history.

Contacts database for the accomplice's information and Wallet pass database for the payment pass details.

Screen Time data for calls to the accomplice and Maps for their location.

A forensic examiner is analyzing an Apple Watch and iPhone pair. The Watch has a workout that shows a heart rate spike at 2:00 PM. The iPhone's Screen Time shows the Maps app was in use at 2:00 PM. The Photos app has a photo geotagged at the same time and location. Which conclusion is most defensible?

The user was driving and using Maps, and the heart rate spike was due to stress.

The user was running and took a photo, but the Maps usage was from a different person.

The heart rate spike was caused by the photo's flash.

The user was exercising while using Maps and took a photo at that location.

GIAC iOS and macOS Examiner

Domain 3Objective 1

Apple Application Analysis GIME Practice Questions (Page 10)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 46–47

46application · medium
In a fraud investigation, you need to determine if a suspect's iPhone contains a contact that matches a known accomplice, and whether that accomplice's phone number was used to set up a payment pass in Wallet. Which data sources would you analyze?
Select an answer first
47expert · hard
A forensic examiner is analyzing an Apple Watch and iPhone pair. The Watch has a workout that shows a heart rate spike at 2:00 PM. The iPhone's Screen Time shows the Maps app was in use at 2:00 PM. The Photos app has a photo geotagged at the same time and location. Which conclusion is most defensible?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Apple Application Analysis GIME Practice Questions (Page 10)

Questions 46–47

In a fraud investigation, you need to determine if a suspect's iPhone contains a contact that matches a known accomplice, and whether that accomplice's phone number was used to set up a payment pass in Wallet. Which data sources would you analyze?

Keep studying — Application and Data Analysis