An examiner finds a Wallet pass on an iPhone and a corresponding pass on an Apple Watch. The iPhone pass shows a different barcode than the Watch pass. The user claims the Watch pass is the one they used. Which data source would help determine which pass was actually used?

The Apple Watch's usage logs for the Wallet app.

The Wallet pass's transaction history on the iPhone.

The pass issuer's server logs showing which barcode was scanned.

The iPhone's Screen Time data for the Wallet app.

You are investigating a suspect's iPhone. The suspect claims they never left home on a certain day, but Maps significant locations show they were at a shopping mall. The suspect argues that the Maps data is inaccurate. Which additional data source would best corroborate the Maps data?

Screen Time data showing the Maps app was used that day.

Contacts database for people who might have been at the mall.

Apple Watch health data showing steps taken that day.

Wallet transaction history showing a purchase at the mall.

An examiner needs to recover deleted Notes content from an iPhone backup. The Notes database is present, but the note body text is not visible in the main table. Which step is most likely to reveal the deleted note content?

Search the backup's Notes database for the note's creation date and metadata only.

Restore the backup to a different iPhone and open the Notes app to view the deleted note.

Look for the note's content in the associated ZICNOTEDATA table or in the note's attached files within the backup.

Use a hex editor to scan the raw backup for the note's title string.

GIAC iOS and macOS Examiner

Domain 3Objective 1

Apple Application Analysis GIME Practice Questions (Page 6)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 26–30

26expert · hard
An examiner finds a Wallet pass on an iPhone and a corresponding pass on an Apple Watch. The iPhone pass shows a different barcode than the Watch pass. The user claims the Watch pass is the one they used. Which data source would help determine which pass was actually used?
Select an answer first
27expert · hard
You are investigating a suspect's iPhone. The suspect claims they never left home on a certain day, but Maps significant locations show they were at a shopping mall. The suspect argues that the Maps data is inaccurate. Which additional data source would best corroborate the Maps data?
Select an answer first
28foundation · easy
In the Health app's SQLite database, which table is specifically used to store workout sessions (e.g., running, cycling) recorded by the Apple Watch?
Select an answer first
29foundation · easy
In the knowledgeC.db database, which table is commonly used to store app usage events for Screen Time analysis?
Select an answer first
30application · medium
An examiner needs to recover deleted Notes content from an iPhone backup. The Notes database is present, but the note body text is not visible in the main table. Which step is most likely to reveal the deleted note content?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Apple Application Analysis GIME Practice Questions (Page 6)

Questions 26–30

An examiner finds a Wallet pass on an iPhone and a corresponding pass on an Apple Watch. The iPhone pass shows a different barcode than the Watch pass. The user claims the Watch pass is the one they used. Which data source would help determine which pass was actually used?

You are investigating a suspect's iPhone. The suspect claims they never left home on a certain day, but Maps significant locations show they were at a shopping mall. The suspect argues that the Maps data is inaccurate. Which additional data source would best corroborate the Maps data?

In the Health app's SQLite database, which table is specifically used to store workout sessions (e.g., running, cycling) recorded by the Apple Watch?

In the knowledgeC.db database, which table is commonly used to store app usage events for Screen Time analysis?

An examiner needs to recover deleted Notes content from an iPhone backup. The Notes database is present, but the note body text is not visible in the main table. Which step is most likely to reveal the deleted note content?

Keep studying — Application and Data Analysis