
GIAC iOS and macOS Examiner
Domain 3Objective 1
Apple Application Analysis GIME Practice Questions (Page 3)
Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)
47questions here
10free pages
7concepts
Questions 11–15
- 11
An examiner is investigating a user who claims they were at home all day. The Maps app shows a search for a restaurant, and the Contacts app has the restaurant's address. The device's location history shows the device at the restaurant for 30 minutes. Which evidence would most strongly contradict the user's claim?
Select an answer first - 12
In the iOS Contacts app's SQLite database, which table stores the actual phone-number values associated with a contact record?
Select an answer first - 13
You are analyzing a Photos library to find all photos taken at a specific location on a specific date. The photos were imported from an iPhone and may have been edited. Which approach will yield the most complete set of photos?
Select an answer first - 14
When analyzing the iOS Wallet app's data, which file format is used to store the actual pass information (such as boarding passes and coupons) that can be parsed to extract pass details?
Select an answer first - 15
You are examining a device to determine if a user took a photo at a specific time and location, and whether they were physically active around that time. Which data sources would you combine?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.