GIAC iOS and macOS Examiner
Domain 2Objective 1
Apple File System Artifacts GIME Practice Questions (Page 1)
Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)
26questions here
6free pages
4concepts
Questions 1–5
- 1
Which macOS artifact is most commonly used to determine when a user logged into the system and when they logged out?
Select an answer first - 2
An analyst wants to identify which applications a user launched on a macOS system. Which artifact would provide the most direct evidence of application execution?
Select an answer first - 3
During a forensic examination of a macOS system, an analyst wants to identify the exact time a specific file was created on the APFS volume. Which artifact most directly records the file creation timestamp?
Select an answer first - 4
An examiner is analyzing a macOS system where a user is suspected of creating a sensitive document and then deleting it. The examiner needs to establish the timeline of the file's creation and the last metadata change before deletion. Which combination of artifacts would provide the most reliable evidence for this timeline?
Select an answer first - 5
Which macOS artifact records the unique identifier of a USB device that was connected to the system?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.