An examiner finds a contact in the Contacts app with an address that matches a location in Maps search history. The same address appears in a Wallet pass as a billing address. The user claims they never visited that location. Which evidence would most strongly refute the user's claim?

The Maps search history showing the address was searched.

The Wallet pass's transaction history showing a purchase at that location.

The Contacts app's 'Last Updated' timestamp for the address.

The Maps app's 'Favorites' list containing the address.

In a fraud investigation, you need to establish whether a suspect's iPhone was used to make a payment at a specific merchant and whether the suspect's contact information was used in the transaction. Which data sources would you analyze?

Notes app for payment confirmations and Maps for the merchant's location.

Wallet transaction history and the associated payment network's server logs.

Screen Time data for payment app usage and Photos for receipts.

Wallet pass database for transaction records and Contacts database for the suspect's details.

A forensic examiner needs to reconstruct a suspect's travel route on a specific day. The suspect used an iPhone with Maps and had Contacts entries for several locations. Which data set would most reliably show the route taken?

The device's significant location history stored in the locationd database.

The Maps app's search history and recent route queries.

The Contacts app's address fields for each location visited.

The Photos app's geotagged images taken during the day.

GIAC iOS and macOS Examiner

Domain 3Objective 1

Apple Application Analysis GIME Practice Questions (Page 8)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 36–40

36expert · hard
An examiner finds a contact in the Contacts app with an address that matches a location in Maps search history. The same address appears in a Wallet pass as a billing address. The user claims they never visited that location. Which evidence would most strongly refute the user's claim?
Select an answer first
37foundation · easy
Which table within the geod.db database is specifically used to store the user's Maps search history entries?
Select an answer first
38application · medium
In a fraud investigation, you need to establish whether a suspect's iPhone was used to make a payment at a specific merchant and whether the suspect's contact information was used in the transaction. Which data sources would you analyze?
Select an answer first
39foundation · easy
Which SQLite database on iOS stores Screen Time usage data, including app usage times and category totals?
Select an answer first
40application · medium
A forensic examiner needs to reconstruct a suspect's travel route on a specific day. The suspect used an iPhone with Maps and had Contacts entries for several locations. Which data set would most reliably show the route taken?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Apple Application Analysis GIME Practice Questions (Page 8)

Questions 36–40

An examiner finds a contact in the Contacts app with an address that matches a location in Maps search history. The same address appears in a Wallet pass as a billing address. The user claims they never visited that location. Which evidence would most strongly refute the user's claim?

Which table within the geod.db database is specifically used to store the user's Maps search history entries?

In a fraud investigation, you need to establish whether a suspect's iPhone was used to make a payment at a specific merchant and whether the suspect's contact information was used in the transaction. Which data sources would you analyze?

Which SQLite database on iOS stores Screen Time usage data, including app usage times and category totals?

A forensic examiner needs to reconstruct a suspect's travel route on a specific day. The suspect used an iPhone with Maps and had Contacts entries for several locations. Which data set would most reliably show the route taken?

Keep studying — Application and Data Analysis