Which of the following is the most reliable way to determine the last login time for a local user account on macOS?

Check the user's shell history file

Check the user's home directory modification time

A user's Mac was recently restored from a backup, and you need to determine the original OS installation date before the restore. Which log file or metadata source would contain the earliest evidence of the original OS installation?

The creation date of /System/Library/CoreServices/SystemVersion.plist

The 'Last Backup' date from Time Machine preferences

The 'Install Date' in /var/db/.AppleSetupDone

The timestamp of /var/log/install.log

In a forensic examination of a Mac, you need to establish when the operating system was installed and when the device last backed up to a local Time Machine drive. Which two artifacts would you consult?

The system's serial number and the Wi-Fi MAC address

The network interface configuration and the DHCP lease history

The `/etc/passwd` file for user creation dates and the system's UUID

The `/var/log/install.log` for the OS installation date and the `com.apple.TimeMachine` preferences plist for the last backup date

You are investigating a macOS device that was replaced under warranty. The original device's serial number is known, but the replacement device has a different serial number. You need to determine if the replacement device was set up by restoring a backup from the original device. Which evidence would be most indicative?

The configuration profile list and the device's UUID

The user's last login time and the Wi-Fi network list

The replacement device's hardware model and OS installation date

The presence of the original device's serial number in the backup metadata or the user's home directory

An organization's Mac is not receiving MDM push notifications, and you suspect a configuration profile is blocking the MDM server's IP address. Which data source would you examine to confirm the profile's restriction payload?

The 'Network' section from system_profiler SPNetworkDataType

The 'ManagedPreferences' from /Library/Managed Preferences

The 'PayloadType' and 'PayloadContent' from the profile's plist in /var/db/ConfigurationProfiles/Store

The 'Logs' from /var/log/install.log

GIAC iOS and macOS Examiner

Domain 4Objective 1

Apple Systems Triage GIME Practice Questions (Page 4)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

5concepts

Questions 16–20

16foundation · easy
Which of the following is the most reliable way to determine the last login time for a local user account on macOS?
Select an answer first
17application · medium
A user's Mac was recently restored from a backup, and you need to determine the original OS installation date before the restore. Which log file or metadata source would contain the earliest evidence of the original OS installation?
Select an answer first
18application · medium
In a forensic examination of a Mac, you need to establish when the operating system was installed and when the device last backed up to a local Time Machine drive. Which two artifacts would you consult?
Select an answer first
19expert · hard
You are investigating a macOS device that was replaced under warranty. The original device's serial number is known, but the replacement device has a different serial number. You need to determine if the replacement device was set up by restoring a backup from the original device. Which evidence would be most indicative?
Select an answer first
20application · medium
An organization's Mac is not receiving MDM push notifications, and you suspect a configuration profile is blocking the MDM server's IP address. Which data source would you examine to confirm the profile's restriction payload?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.