A company is investigating a leak of a confidential PDF that was stored in a shared iCloud Drive folder. The investigator has access to the corporate MDM logs, the suspect's Mac, and the suspect's iPhone. The PDF was downloaded to the iPhone, but the investigator needs to determine whether the suspect also accessed it on the Mac. Which evidence would be most conclusive?

The iPhone's CloudKit download log for the PDF.

The corporate MDM logs showing the Mac's iCloud account sign-in.

The iCloud Drive server logs from Apple (if obtainable).

The presence of the PDF in the Mac's local iCloud Drive cache and the file's last opened timestamp.

Which file system artifact on macOS is specifically associated with the Versions feature and can reveal the existence of previous document versions?

The .DocumentRevisions-V100 directory

What is the primary purpose of APFS snapshots in the context of iCloud data analysis?

To compress files to save storage space.

To automatically back up iCloud data to an external drive.

To provide a point-in-time view of the file system that can reveal changes over time.

To encrypt iCloud data at rest.

An examiner is analyzing an iPhone that syncs photos with iCloud Photos. The examiner needs to determine whether a specific photo was originally captured on this iPhone or synced from another device. Which artifact would be most useful?

The photo's file name in the iCloud Photos library.

The photo's iCloud sync log entry showing a download operation.

The photo's EXIF metadata, including the original capture device and timestamp.

The photo's location in the file system (e.g., DCIM folder).

GIAC iOS and macOS Examiner

Domain 3Objective 3

Document and iCloud Analysis GIME Practice Questions (Page 6)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

Questions 26–29

26expert · hard
A company is investigating a leak of a confidential PDF that was stored in a shared iCloud Drive folder. The investigator has access to the corporate MDM logs, the suspect's Mac, and the suspect's iPhone. The PDF was downloaded to the iPhone, but the investigator needs to determine whether the suspect also accessed it on the Mac. Which evidence would be most conclusive?
Select an answer first
27foundation · easy
Which file system artifact on macOS is specifically associated with the Versions feature and can reveal the existence of previous document versions?
Select an answer first
28foundation · easy
What is the primary purpose of APFS snapshots in the context of iCloud data analysis?
Select an answer first
29application · medium
An examiner is analyzing an iPhone that syncs photos with iCloud Photos. The examiner needs to determine whether a specific photo was originally captured on this iPhone or synced from another device. Which artifact would be most useful?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Document and iCloud Analysis GIME Practice Questions (Page 6)

Questions 26–29

Which file system artifact on macOS is specifically associated with the Versions feature and can reveal the existence of previous document versions?

What is the primary purpose of APFS snapshots in the context of iCloud data analysis?

An examiner is analyzing an iPhone that syncs photos with iCloud Photos. The examiner needs to determine whether a specific photo was originally captured on this iPhone or synced from another device. Which artifact would be most useful?

Keep studying — Application and Data Analysis