During a forensic examination of a Mac, you find a Notes database that contains multiple versions of a note. You need to establish a timeline of when each version was created and last edited. Which artifact would be most useful?

The iCloud sync log entries for the Notes app.

The 'NoteHistory' table in the Notes database, which stores snapshots of each version with timestamps.

The note's 'creationDate' and 'lastModifiedDate' fields in the Notes SQLite database.

The file system timestamps of the Notes database file itself.

An examiner is analyzing a Mac that syncs a folder of documents with iCloud Drive. The examiner needs to determine whether a specific file was recently modified on the Mac or on another device. Which combination of artifacts should the examiner examine to make this determination?

The file's ACL permissions and the user's login history.

The file's extended attributes and the contents of the iCloud Drive trash.

The file's local metadata (creation/modification dates) and the iCloud sync log entries for that file.

The file's quarantine attribute and the system's unified log for the iCloud daemon.

An organization uses iCloud Drive to share a large Keynote presentation among employees. A forensic examiner needs to determine whether a specific employee's Mac uploaded a modified version of the file to iCloud at a particular time. Which combination of artifacts would provide the most reliable evidence?

The file's version history in Keynote and the iCloud Drive 'Recently Deleted' folder.

The file's local extended attributes (com.apple.icloud.downloaded) and the iCloud sync log on the Mac.

The file's modification timestamp on the Mac and the iCloud Drive audit log from the corporate MDM.

The file's last modified timestamp in iCloud Drive metadata and the unified log entries for cloudd on the Mac.

GIAC iOS and macOS Examiner

Domain 3Objective 3

Document and iCloud Analysis GIME Practice Questions (Page 2)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

Questions 6–10

6foundation · easy
Which component of iCloud is responsible for synchronizing document and app data across a user's devices?
Select an answer first
7application · medium
During a forensic examination of a Mac, you find a Notes database that contains multiple versions of a note. You need to establish a timeline of when each version was created and last edited. Which artifact would be most useful?
Select an answer first
8foundation · easy
Which log or database on macOS or iOS is most likely to contain records of iCloud document sync activity?
Select an answer first
9application · medium
An examiner is analyzing a Mac that syncs a folder of documents with iCloud Drive. The examiner needs to determine whether a specific file was recently modified on the Mac or on another device. Which combination of artifacts should the examiner examine to make this determination?
Select an answer first
10application · medium
An organization uses iCloud Drive to share a large Keynote presentation among employees. A forensic examiner needs to determine whether a specific employee's Mac uploaded a modified version of the file to iCloud at a particular time. Which combination of artifacts would provide the most reliable evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Document and iCloud Analysis GIME Practice Questions (Page 2)

Questions 6–10

Which component of iCloud is responsible for synchronizing document and app data across a user's devices?

During a forensic examination of a Mac, you find a Notes database that contains multiple versions of a note. You need to establish a timeline of when each version was created and last edited. Which artifact would be most useful?

Which log or database on macOS or iOS is most likely to contain records of iCloud document sync activity?

An examiner is analyzing a Mac that syncs a folder of documents with iCloud Drive. The examiner needs to determine whether a specific file was recently modified on the Mac or on another device. Which combination of artifacts should the examiner examine to make this determination?

Keep studying — Application and Data Analysis