Which macOS command lists all local user accounts along with their UID, primary group ID, and home directory?

dscl . -list /Users UniqueID PrimaryGroupID NFSHomeDirectory

During a triage of a macOS system, you discover a configuration profile that restricts the ability to modify network settings. You also notice a user account that was created around the same time the profile was installed. Which action would best help you determine if the profile was installed by an MDM server or manually?

Examine the user's last login time and the OS installation date

Review the system's serial number and hardware model

Check the profile's installation log entries and the profile's signing certificate

Compare the profile's payload to the user's home directory contents

An incident responder needs to identify a Mac that was used to exfiltrate data. The only evidence is a network log showing the MAC address of the Wi-Fi interface and the IP address it used. The Mac has been turned off and on, and the Wi-Fi is now connected to a different network. The responder needs to confirm the device's identity and determine whether the OS was reinstalled after the incident. Which approach will provide the most reliable evidence?

Boot the Mac normally and run ifconfig and system_profiler SPSoftwareDataType

Check the router's DHCP logs and compare the MAC address to the current one

Use the recovery partition to run 'networksetup -listallhardwareports' and 'system_profiler SPHardwareDataType'

Boot the Mac in target disk mode and examine the raw disk for the Wi-Fi MAC address in the network configuration plists and the OS install date in the system logs

An iOS device is suspected of connecting to a rogue Wi-Fi network. You have a full file system image. Which set of artifacts would best reveal the Wi-Fi networks the device has joined and the associated IP addresses?

The `com.apple.wifi.known-networks.plist` and the `wifi` interface logs in the unified log

The configuration profile list and the device's UUID

The device's serial number and hardware model

The user account database and last login times

An organization's Mac is enrolled in an MDM and a user reports that they cannot change the network proxy settings. You need to verify whether a configuration profile is enforcing this restriction. Which command will list all installed configuration profiles including those from MDM?

system_profiler SPConfigurationProfileDataType

sudo security authorizationdb read system.preferences.network

defaults read /Library/Managed Preferences

profiles show -type configuration

GIAC iOS and macOS Examiner

Domain 4Objective 1

Apple Systems Triage GIME Practice Questions (Page 1)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

5concepts

Questions 1–5

1foundation · easy
Which macOS command lists all local user accounts along with their UID, primary group ID, and home directory?
Select an answer first
2application · medium
During a triage of a macOS system, you discover a configuration profile that restricts the ability to modify network settings. You also notice a user account that was created around the same time the profile was installed. Which action would best help you determine if the profile was installed by an MDM server or manually?
Select an answer first
3expert · hard
An incident responder needs to identify a Mac that was used to exfiltrate data. The only evidence is a network log showing the MAC address of the Wi-Fi interface and the IP address it used. The Mac has been turned off and on, and the Wi-Fi is now connected to a different network. The responder needs to confirm the device's identity and determine whether the OS was reinstalled after the incident. Which approach will provide the most reliable evidence?
Select an answer first
4application · medium
An iOS device is suspected of connecting to a rogue Wi-Fi network. You have a full file system image. Which set of artifacts would best reveal the Wi-Fi networks the device has joined and the associated IP addresses?
Select an answer first
5application · medium
An organization's Mac is enrolled in an MDM and a user reports that they cannot change the network proxy settings. You need to verify whether a configuration profile is enforcing this restriction. Which command will list all installed configuration profiles including those from MDM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Apple Systems Triage GIME Practice Questions (Page 1)

Questions 1–5

Which macOS command lists all local user accounts along with their UID, primary group ID, and home directory?

An iOS device is suspected of connecting to a rogue Wi-Fi network. You have a full file system image. Which set of artifacts would best reveal the Wi-Fi networks the device has joined and the associated IP addresses?

An organization's Mac is enrolled in an MDM and a user reports that they cannot change the network proxy settings. You need to verify whether a configuration profile is enforcing this restriction. Which command will list all installed configuration profiles including those from MDM?

Keep studying — Incident Response and Advanced Techniques