A Mac was used to access a sensitive server via a VPN. The VPN logs show the source IP address and the MAC address of the interface that carried the VPN traffic. The Mac has since been rebooted and the VPN is disconnected. You need to confirm that the Mac's interface MAC address matches the VPN logs and determine when the OS was last booted. Which commands will provide this evidence?

ifconfig -a and sysctl kern.boottime

networksetup -listallhardwareports and system_profiler SPSoftwareDataType

GIAC iOS and macOS Examiner

Domain 4Objective 1

Apple Systems Triage GIME Practice Questions (Page 8)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

5concepts

Questions 36–36

36expert · hard
A Mac was used to access a sensitive server via a VPN. The VPN logs show the source IP address and the MAC address of the interface that carried the VPN traffic. The Mac has since been rebooted and the VPN is disconnected. You need to confirm that the Mac's interface MAC address matches the VPN logs and determine when the OS was last booted. Which commands will provide this evidence?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Apple Systems Triage GIME Practice Questions (Page 8)

Questions 36–36

Keep studying — Incident Response and Advanced Techniques