You are investigating a macOS system where a user account was used to access sensitive files. You need to determine the last login time and whether the account is a local or mobile account. Which two artifacts would you examine?

The configuration profile list and the device's UUID

The Wi-Fi network list and the IP address

The system's serial number and the OS installation date

The `last` command output and the account's attributes in the directory service database

A Mac has a user account that appears to have been created by an unauthorized party. You need to determine when the account was created and whether it has administrative privileges. Which commands will provide this information?

dscl . -read /Users/username and dscl . -read /Groups/admin GroupMembership

defaults read /Library/Preferences/com.apple.loginwindow and ls -la /Users

system_profiler SPSoftwareDataType and w

During a triage, you need to correlate a specific iOS device to a user account in your directory service. The device is enrolled in MDM and has a corporate Wi-Fi profile. Which combination of identifiers would uniquely tie the device to the user?

The device's serial number and the user's mobile account name from the MDM enrollment record

The device's UUID and the user's group memberships

The device's hardware model and the user's home directory path

The device's Wi-Fi MAC address and the user's last login time

GIAC iOS and macOS Examiner

Domain 4Objective 1

Apple Systems Triage GIME Practice Questions (Page 6)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

5concepts

Questions 26–30

26foundation · easy
Which command-line tool on macOS is used to enumerate and inspect configuration profiles installed on the system?
Select an answer first
27foundation · easy
Which macOS command displays the IP address, subnet mask, and other network configuration for all active interfaces?
Select an answer first
28application · medium
You are investigating a macOS system where a user account was used to access sensitive files. You need to determine the last login time and whether the account is a local or mobile account. Which two artifacts would you examine?
Select an answer first
29application · medium
A Mac has a user account that appears to have been created by an unauthorized party. You need to determine when the account was created and whether it has administrative privileges. Which commands will provide this information?
Select an answer first
30application · medium
During a triage, you need to correlate a specific iOS device to a user account in your directory service. The device is enrolled in MDM and has a corporate Wi-Fi profile. Which combination of identifiers would uniquely tie the device to the user?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Apple Systems Triage GIME Practice Questions (Page 6)

Questions 26–30

Which command-line tool on macOS is used to enumerate and inspect configuration profiles installed on the system?

Which macOS command displays the IP address, subnet mask, and other network configuration for all active interfaces?

You are investigating a macOS system where a user account was used to access sensitive files. You need to determine the last login time and whether the account is a local or mobile account. Which two artifacts would you examine?

A Mac has a user account that appears to have been created by an unauthorized party. You need to determine when the account was created and whether it has administrative privileges. Which commands will provide this information?

During a triage, you need to correlate a specific iOS device to a user account in your directory service. The device is enrolled in MDM and has a corporate Wi-Fi profile. Which combination of identifiers would uniquely tie the device to the user?

Keep studying — Incident Response and Advanced Techniques