A forensic examiner is comparing two versions of a Microsoft Word document recovered from a Mac. The examiner wants to identify which specific paragraphs were added or removed between the versions. Which method is most appropriate for this task?

Compare the file sizes and creation dates of both versions.

Examine the file's extended attributes for a version identifier.

Use a text-comparison tool to diff the extracted text content of both versions.

Open both versions in Word and use the Track Changes feature to see edits.

In iCloud, how are changes to a document typically propagated to other devices?

Each device sends the entire updated file to all other devices via peer-to-peer networking.

The device uploads the change to iCloud, which then pushes the change to other devices.

Changes are only synced when the user manually triggers a sync in Settings.

Changes are stored locally and merged only when devices are on the same Wi-Fi network.

During an investigation, you find a Pages document on a Mac with multiple versions in its Version History. You need to determine whether a specific version was created while the user was editing on their iPad. Which forensic artifact would help answer this?

The modification timestamp of the version compared to the iPad's usage logs.

The iCloud sync log on the Mac, which records the source device for each sync operation.

The 'Device' field in the version metadata within the Pages file.

The file's extended attribute 'com.apple.icloud.lastSyncDevice'.

An examiner is comparing two versions of a text document that were recovered from different locations on a Mac. The examiner needs to determine which version is older. The file metadata for both versions shows the same creation date, but the modification dates differ. Which additional artifact should the examiner examine to determine the older version?

The file's Spotlight comment, which may contain a version note.

The file's ACLs, which may indicate which user created it.

The file's quarantine attribute, which may indicate when it was downloaded.

The file's extended attributes, which may contain a version identifier or sync timestamp.

A forensic examiner is investigating a dispute over a contract document edited in Pages on a Mac. The examiner has the current version and the Version History. The examiner needs to prove that a specific paragraph was added in a version created at 2:00 PM. Which approach would be most reliable?

Extract the underlying document data from the version's snapshot (e.g., from the APFS snapshot) and perform a text-level comparison.

Check the file's modification timestamp in the iCloud sync log.

Export the version from 2:00 PM as a PDF and compare it with the previous version.

Open the Version History and visually inspect the version from 2:00 PM.

GIAC iOS and macOS Examiner

Domain 3Objective 3

Document and iCloud Analysis GIME Practice Questions (Page 1)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

Questions 1–5

1application · medium
A forensic examiner is comparing two versions of a Microsoft Word document recovered from a Mac. The examiner wants to identify which specific paragraphs were added or removed between the versions. Which method is most appropriate for this task?
Select an answer first
2foundation · easy
In iCloud, how are changes to a document typically propagated to other devices?
Select an answer first
3application · medium
During an investigation, you find a Pages document on a Mac with multiple versions in its Version History. You need to determine whether a specific version was created while the user was editing on their iPad. Which forensic artifact would help answer this?
Select an answer first
4expert · hard
An examiner is comparing two versions of a text document that were recovered from different locations on a Mac. The examiner needs to determine which version is older. The file metadata for both versions shows the same creation date, but the modification dates differ. Which additional artifact should the examiner examine to determine the older version?
Select an answer first
5expert · hard
A forensic examiner is investigating a dispute over a contract document edited in Pages on a Mac. The examiner has the current version and the Version History. The examiner needs to prove that a specific paragraph was added in a version created at 2:00 PM. Which approach would be most reliable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.