You are analyzing a device where the user has deleted several photos. You need to recover evidence that the photos were taken and possibly shared via Notes. Which approach would be most effective?

Analyze Screen Time data to see when the Photos app was used.

Analyze Apple Watch health data to see if the user was active when the photos were taken.

Analyze Maps significant locations to see where the photos were taken.

Analyze the Photos database for deleted photo metadata and the Notes database for any embedded images.

You are investigating a missing person case. The person's iPhone is available, and you need to reconstruct their recent movements. Which data source would provide the most detailed location history?

Wallet transaction history, which shows merchant locations.

Photos database, which may contain GPS-tagged photos.

Screen Time data, which logs app usage by location.

Maps app's 'Significant Locations' database, which records frequented places with timestamps.

A parent suspects their child is using an iPhone excessively and wants to know which apps are used most and whether any restrictions are being bypassed. You are asked to analyze the device. Which data source would provide the most comprehensive usage and restriction information?

Apple Watch health data, which records activity and app usage on the watch.

Photos database, which may show screenshots of usage reports.

Screen Time database, which logs app usage and contains restriction settings.

Maps search history, which can indicate location-based app usage.

A parent wants to know if their child has been using the Notes app to communicate with someone during restricted hours. Which data source would provide the most relevant evidence?

Screen Time database for app usage timestamps and Notes database for note content and creation times.

Maps search history for locations visited during restricted hours.

Contacts database for the person the child might be communicating with.

Wallet transaction history for any purchases related to Notes.

GIAC iOS and macOS Examiner

Domain 3Objective 1

Apple Application Analysis GIME Practice Questions (Page 5)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 21–25

21expert · hard
You are analyzing a device where the user has deleted several photos. You need to recover evidence that the photos were taken and possibly shared via Notes. Which approach would be most effective?
Select an answer first
22application · medium
You are investigating a missing person case. The person's iPhone is available, and you need to reconstruct their recent movements. Which data source would provide the most detailed location history?
Select an answer first
23application · medium
A parent suspects their child is using an iPhone excessively and wants to know which apps are used most and whether any restrictions are being bypassed. You are asked to analyze the device. Which data source would provide the most comprehensive usage and restriction information?
Select an answer first
24application · medium
A parent wants to know if their child has been using the Notes app to communicate with someone during restricted hours. Which data source would provide the most relevant evidence?
Select an answer first
25foundation · easy
When analyzing the iOS Notes app's SQLite database, which table contains the actual note content (the body text) that a user typed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.