You are examining a Mac that was backed up to a network Time Machine drive. The backup logs show a gap of several days. You need to determine if the device was offline or if the backup failed. Which artifact would best help you distinguish between these possibilities?

The user's last login time and the OS installation date

The Wi-Fi network list and the IP address

The system's power and sleep logs during the gap period

The device's serial number and hardware model

During an incident response, you need to confirm that a seized MacBook Pro is the specific device associated with a user's cloud account. You have access to the device's login window and can run terminal commands as an administrator. Which combination of commands will provide the most reliable set of system identifiers for this confirmation?

system_profiler SPHardwareDataType and networksetup -listallhardwareports

defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences and dmesg

system_profiler SPSoftwareDataType and sw_vers

ifconfig and route -n get default

A user reports that their macOS device cannot join a new Wi-Fi network and that several system settings are grayed out. You suspect a configuration profile is enforcing restrictions. Which step would most directly confirm that a profile is the cause?

Examine the system log for Wi-Fi association failures

Check the Wi-Fi interface's IP address and subnet mask

Run `profiles show -type configuration` to list installed profiles and inspect their payloads

Review the user account's last login time and group memberships

You are triaging an iPhone that was found in a corporate office. The device is locked, but you have physical access and can connect it to a trusted computer. Which method will allow you to retrieve the device's UDID without unlocking the device?

Use 'defaults read /Library/Preferences/com.apple.iPod.plist' on the Mac

Connect the iPhone to a Mac and use 'idevice_id -l' from libimobiledevice

Use 'system_profiler SPUSBDataType' on the Mac to read the serial number

Check the device's Settings app under General > About

A macOS device is suspected of using a malicious DNS server. The device is enrolled in MDM and has a configuration profile that sets a specific DNS server. You need to determine whether the device is actually using the profile's DNS server or a different one. Which approach would be most conclusive?

Compare the DNS server in the profile payload with the DNS server in the active network configuration and check for any VPN or proxy that might override it

Examine the Wi-Fi known networks list

Review the user's last login time and the OS installation date

Check the device's serial number and hardware model

GIAC iOS and macOS Examiner

Domain 4Objective 1

Apple Systems Triage GIME Practice Questions (Page 7)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

5concepts

Questions 31–35

31expert · hard
You are examining a Mac that was backed up to a network Time Machine drive. The backup logs show a gap of several days. You need to determine if the device was offline or if the backup failed. Which artifact would best help you distinguish between these possibilities?
Select an answer first
32application · medium
During an incident response, you need to confirm that a seized MacBook Pro is the specific device associated with a user's cloud account. You have access to the device's login window and can run terminal commands as an administrator. Which combination of commands will provide the most reliable set of system identifiers for this confirmation?
Select an answer first
33application · medium
A user reports that their macOS device cannot join a new Wi-Fi network and that several system settings are grayed out. You suspect a configuration profile is enforcing restrictions. Which step would most directly confirm that a profile is the cause?
Select an answer first
34application · medium
You are triaging an iPhone that was found in a corporate office. The device is locked, but you have physical access and can connect it to a trusted computer. Which method will allow you to retrieve the device's UDID without unlocking the device?
Select an answer first
35expert · hard
A macOS device is suspected of using a malicious DNS server. The device is enrolled in MDM and has a configuration profile that sets a specific DNS server. You need to determine whether the device is actually using the profile's DNS server or a different one. Which approach would be most conclusive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Apple Systems Triage GIME Practice Questions (Page 7)

Questions 31–35

You are examining a Mac that was backed up to a network Time Machine drive. The backup logs show a gap of several days. You need to determine if the device was offline or if the backup failed. Which artifact would best help you distinguish between these possibilities?

A user reports that their macOS device cannot join a new Wi-Fi network and that several system settings are grayed out. You suspect a configuration profile is enforcing restrictions. Which step would most directly confirm that a profile is the cause?

You are triaging an iPhone that was found in a corporate office. The device is locked, but you have physical access and can connect it to a trusted computer. Which method will allow you to retrieve the device's UDID without unlocking the device?

Keep studying — Incident Response and Advanced Techniques