Application Fundamentals GIME Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A forensic examiner is analyzing an iOS app's data container. The examiner finds a file named 'data.sqlite' in the Documents directory and a file named 'preferences.plist' in the Library/Preferences directory. What is the most likely purpose of each file?

   • Adata.sqlite stores structured user data; preferences.plist stores app settings.
   • BBoth files store the same data in different formats.
   • Cdata.sqlite stores app settings; preferences.plist stores user data.
   • Ddata.sqlite is a backup of preferences.plist.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An examiner is analyzing a macOS application that stores user preferences in a binary property list. Which tool or command can convert this binary plist to a readable XML format for inspection?

   • Asqlite3 preferences.plist
   • Bdefaults read preferences.plist
   • Cstrings preferences.plist
   • Dplutil -convert xml1 preferences.plist
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An examiner is analyzing a macOS app's SQLite database that has a 'logs' table with columns 'id', 'event', 'timestamp'. The examiner needs to find the most recent event for each type of event. Which SQL query should be used?

   • ASELECT event, timestamp FROM logs WHERE timestamp = (SELECT MAX(timestamp) FROM logs);
   • BSELECT event, timestamp FROM logs ORDER BY timestamp DESC LIMIT 1;
   • CSELECT event, MAX(timestamp) FROM logs GROUP BY event;
   • DSELECT DISTINCT event, timestamp FROM logs ORDER BY timestamp DESC;
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A forensic examiner is analyzing a macOS application's Core Data store. The examiner needs to understand the entity-relationship model. Which file in the application bundle should be examined first?

   • AThe Info.plist file
   • BThe .strings file
   • CThe .xcdatamodeld file
   • DThe .sqlite file
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A forensic examiner is analyzing an iOS app that uses both a property list for configuration and a SQLite database for user data. The examiner needs to correlate a configuration setting from the plist with records in the database. The plist contains a key 'userID' and the database has a 'users' table with a 'user_id' column. What is the most reliable way to perform this correlation?

   • AUse the plist as a SQLite database and join it with the users table.
   • BRead the plist to get the userID value, then query the database with SELECT * FROM users WHERE user_id = '<value>';
   • CQuery the database first to list all user IDs, then manually match them to the plist value.
   • DConvert the plist to XML and search for the userID in the database dump.
   Reveal Solution Discussion Select an answer first