A forensic examiner is building a timeline of a Mac's usage. They need to determine the last time a backup occurred and whether any user accounts were created after that backup. Which data sources should they examine?

The creation date of /Volumes/Backup and the 'UID' of user accounts

The modification time of /Library/Preferences/com.apple.TimeMachine.plist and the 'Last Login' from the loginwindow

The 'Install Date' from system_profiler and the 'Password Last Set' from dscl

The 'Last Backup' date from Time Machine preferences and the 'CreationDate' of user accounts from dscl

An iOS device is suspected of using a VPN to hide its traffic. You have a logical backup. Which artifact would best show whether a VPN configuration profile was installed and active?

The device's serial number and hardware model

The VPN configuration profile in the managed preferences and the VPN connection logs

The user's Apple ID and last login time

The Wi-Fi known networks list and the IP address

You are triaging a macOS system where a user account was deleted, but you need to determine when the account was last used. The system has a configuration profile that enforces password changes every 30 days. Which artifact would provide the most reliable evidence of the account's last use?

The account's last password change timestamp in the directory service database

The account's home directory modification time

The configuration profile's installation date

The system log entries for authentication attempts by that account

A forensic examiner is investigating a Mac that was used by multiple users. The examiner needs to determine which user accounts were created after the last OS update and whether any of those accounts have administrative privileges. The examiner also needs to know if any of the accounts are mobile accounts from a directory service. Which combination of commands will provide all of this information?

defaults read /Library/Preferences/com.apple.loginwindow, dscl . -list /Users, and dscl . -read /Users/username

system_profiler SPSoftwareDataType, dscl . -list /Users, dscl . -read /Groups/admin GroupMembership, and dscl . -read /Users/username AuthenticationAuthority

system_profiler SPHardwareDataType, last, and dscl . -list /Groups/admin

sw_vers, id -Gn, and dscl . -read /Users/username

A macOS system has a local user account that appears to have been created recently, but the system was installed months ago. You need to determine if this account was created by a configuration profile or manually. Which evidence would be most conclusive?

The user's home directory path and the system's serial number

The user's last login time and the OS installation date

The account's creation timestamp in the directory service database compared to the profile installation timestamp

The network configuration and the user's group memberships

GIAC iOS and macOS Examiner

Domain 4Objective 1

Apple Systems Triage GIME Practice Questions (Page 3)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

5concepts

Questions 11–15

11application · medium
A forensic examiner is building a timeline of a Mac's usage. They need to determine the last time a backup occurred and whether any user accounts were created after that backup. Which data sources should they examine?
Select an answer first
12application · medium
An iOS device is suspected of using a VPN to hide its traffic. You have a logical backup. Which artifact would best show whether a VPN configuration profile was installed and active?
Select an answer first
13expert · hard
You are triaging a macOS system where a user account was deleted, but you need to determine when the account was last used. The system has a configuration profile that enforces password changes every 30 days. Which artifact would provide the most reliable evidence of the account's last use?
Select an answer first
14expert · hard
A forensic examiner is investigating a Mac that was used by multiple users. The examiner needs to determine which user accounts were created after the last OS update and whether any of those accounts have administrative privileges. The examiner also needs to know if any of the accounts are mobile accounts from a directory service. Which combination of commands will provide all of this information?
Select an answer first
15application · medium
A macOS system has a local user account that appears to have been created recently, but the system was installed months ago. You need to determine if this account was created by a configuration profile or manually. Which evidence would be most conclusive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.