A Mac was used by multiple employees, and you need to determine which user accounts were created after the company's MDM profile was installed. Which approach will give you the account creation dates and the MDM profile installation date?

Check the 'Last Login' from the loginwindow and the 'Modified' date of the profile plist

Use 'system_profiler SPSoftwareDataType' and 'defaults read /Library/Preferences/com.apple.MCX'

Use 'dscl . -read /Users/username' to get the 'CreationDate' for each account and 'profiles show -type configuration' to see the profile's install date

Examine the /Users directory listing and the /Library/Managed Preferences folder timestamps

You are triaging a Mac that was re-imaged and then connected to a corporate network. You need to confirm that the device's hardware identity is unchanged and that it was indeed re-imaged on a specific date. Which artifacts would you collect?

The serial number and hardware model from the system profiler, and the OS installation date from the install log

The Wi-Fi MAC address and the DHCP lease history

The configuration profile list and the device's UUID

The user account list and last login times

You are triaging a Mac that was re-imaged, but the user claims the OS was installed earlier than the install log suggests. You suspect the system clock was incorrect during installation. Which artifact would help you verify the true installation date?

The device's serial number and hardware model

The creation date of the earliest system files on the boot volume, such as `/System/Library/CoreServices/SystemVersion.plist`

The configuration profile installation dates

The user's last login time and the OS installation date from the install log

You are examining a Mac that was recently restored from a Time Machine backup. You need to determine the original OS installation date and the date of the backup that was restored. Which two artifacts would you use?

The configuration profile list and the device's UUID

The OS installation date from the install log and the backup metadata from the Time Machine backup catalog

The Wi-Fi network list and the DHCP lease history

The system's serial number and the user account creation dates

GIAC iOS and macOS Examiner

Domain 4Objective 1

Apple Systems Triage GIME Practice Questions (Page 2)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

5concepts

Questions 6–10

6application · medium
A Mac was used by multiple employees, and you need to determine which user accounts were created after the company's MDM profile was installed. Which approach will give you the account creation dates and the MDM profile installation date?
Select an answer first
7application · medium
You are triaging a Mac that was re-imaged and then connected to a corporate network. You need to confirm that the device's hardware identity is unchanged and that it was indeed re-imaged on a specific date. Which artifacts would you collect?
Select an answer first
8foundation · easy
During triage of a macOS system, an examiner needs to record a unique identifier that is tied to the specific hardware unit and is commonly used for warranty and inventory tracking. Which identifier should the examiner collect?
Select an answer first
9expert · hard
You are triaging a Mac that was re-imaged, but the user claims the OS was installed earlier than the install log suggests. You suspect the system clock was incorrect during installation. Which artifact would help you verify the true installation date?
Select an answer first
10application · medium
You are examining a Mac that was recently restored from a Time Machine backup. You need to determine the original OS installation date and the date of the backup that was restored. Which two artifacts would you use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.