GIAC iOS and macOS Examiner
Domain 3Objective 1
Apple Application Analysis GIME Practice Questions (Page 9)
Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)
47questions here
10free pages
7concepts
Questions 41–45
- 41
When analyzing Apple Watch health data, which SQLite database on the paired iPhone stores workout and activity data collected by the Watch?
Select an answer first - 42
In a corporate espionage case, you need to determine if an employee used their iPhone to store a competitor's contact in their Contacts and then used that contact to receive a payment via Apple Pay. Which data sources would you analyze?
Select an answer first - 43
In the iOS Maps app's data storage, which SQLite database is the primary repository for location history, search terms, and recent routes?
Select an answer first - 44
A user reports that a boarding pass in Wallet disappeared after they updated their iPhone. You need to determine if the pass was deleted or if it was moved to another device. Which data source would help you confirm the pass's last known location?
Select an answer first - 45
You are examining an iPhone and need to determine whether a user visited a specific location and took photos there. Which combination of data sources would provide the most direct evidence?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.