A forensic examiner is analyzing a macOS application's data directory and finds a file named 'data.sqlite'. The examiner needs to determine which table stores user activity timestamps. Which SQLite command should be used first?

SELECT sql FROM sqlite_master WHERE name='data.sqlite';

PRAGMA table_info(data.sqlite);

SELECT name FROM sqlite_master WHERE type='table';

During an examination of an iOS app, the examiner finds a binary property list file. The examiner needs to view its contents in a human-readable format. Which command-line tool can convert this binary plist to XML?

plutil -convert xml1 file.plist

An examiner is analyzing a macOS app that uses both a property list and a SQLite database. The examiner needs to determine which file contains the app's configuration settings and which contains user activity logs. Which approach is most reliable?

The examiner cannot determine the purpose without running the app.

Both files likely contain the same data.

Inspect the SQLite database for settings and the property list for logs.

Inspect the property list for settings and the SQLite database for logs.

A forensic examiner is analyzing an iOS app that stores user preferences and recent search terms. The examiner finds a file in the app's Library/Preferences directory. Which data structure is most likely used, and what is the most efficient way to view its contents?

SQLite database; open with a SQLite browser

JSON file; parse with a text editor

Core Data store; query with sqlite3

Property list; view with a plist editor or convert with plutil

GIAC iOS and macOS Examiner

Domain 1Objective 3

Application Fundamentals GIME Practice Questions (Page 3)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

3concepts

Questions 11–15

11application · medium
A forensic examiner is analyzing a macOS application's data directory and finds a file named 'data.sqlite'. The examiner needs to determine which table stores user activity timestamps. Which SQLite command should be used first?
Select an answer first
12application · easy
During an examination of an iOS app, the examiner finds a binary property list file. The examiner needs to view its contents in a human-readable format. Which command-line tool can convert this binary plist to XML?
Select an answer first
13application · easy
An examiner is analyzing a macOS app that uses both a property list and a SQLite database. The examiner needs to determine which file contains the app's configuration settings and which contains user activity logs. Which approach is most reliable?
Select an answer first
14application · medium
A forensic examiner is analyzing an iOS app that stores user preferences and recent search terms. The examiner finds a file in the app's Library/Preferences directory. Which data structure is most likely used, and what is the most efficient way to view its contents?
Select an answer first
15foundation · easy
An iOS app uses a framework that manages an object graph and persists it to a store that is often backed by SQLite. Which data structure does this describe?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.