An examiner is analyzing an iOS app's data container and finds a SQLite database. The examiner wants to determine if the database contains any deleted data that might be recoverable. Which approach is most appropriate?

Use the sqlite3 .recover command to attempt to recover deleted rows.

Use the .dump command to see all data including deleted rows.

Open the database in a text editor to find deleted data.

Simply query the tables; deleted data is automatically removed and cannot be recovered.

A forensic examiner is analyzing a macOS application's data directory and finds a file named 'preferences.plist'. The examiner needs to extract a specific key-value pair. Which command should be used?

defaults read preferences.plist

A forensic examiner is analyzing an iOS app that uses Core Data with a SQLite store. The examiner finds a .sqlite file and a -wal file. The examiner needs to extract data from the database, but the -wal file is large and contains many uncheckpointed transactions. What is the most appropriate approach to ensure all data is captured?

Copy only the .sqlite file, as it contains the most recent checkpoint.

Run a checkpoint command on the original database before copying.

Delete the -wal file and copy the .sqlite file.

Copy both the .sqlite and -wal files, then open the database with a SQLite tool that reads WAL files.

GIAC iOS and macOS Examiner

Domain 1Objective 3

Application Fundamentals GIME Practice Questions (Page 4)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

3concepts

Questions 16–20

16foundation · easy
Which of the following is a common data structure used by iOS and macOS applications to store structured, typed data in a single file that can be read and written using Apple's Foundation framework?
Select an answer first
17application · medium
An examiner is analyzing an iOS app's data container and finds a SQLite database. The examiner wants to determine if the database contains any deleted data that might be recoverable. Which approach is most appropriate?
Select an answer first
18foundation · easy
Which SQL clause is used to filter rows returned by a SELECT query based on a condition?
Select an answer first
19application · medium
A forensic examiner is analyzing a macOS application's data directory and finds a file named 'preferences.plist'. The examiner needs to extract a specific key-value pair. Which command should be used?
Select an answer first
20expert · hard
A forensic examiner is analyzing an iOS app that uses Core Data with a SQLite store. The examiner finds a .sqlite file and a -wal file. The examiner needs to extract data from the database, but the -wal file is large and contains many uncheckpointed transactions. What is the most appropriate approach to ensure all data is captured?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Application Fundamentals GIME Practice Questions (Page 4)

Questions 16–20

Which of the following is a common data structure used by iOS and macOS applications to store structured, typed data in a single file that can be read and written using Apple's Foundation framework?

An examiner is analyzing an iOS app's data container and finds a SQLite database. The examiner wants to determine if the database contains any deleted data that might be recoverable. Which approach is most appropriate?

Which SQL clause is used to filter rows returned by a SELECT query based on a condition?

A forensic examiner is analyzing a macOS application's data directory and finds a file named 'preferences.plist'. The examiner needs to extract a specific key-value pair. Which command should be used?

Keep studying — Apple Operating System Fundamentals