An examiner has a memory image from an iOS device and wants to extract the encryption keys for the Keychain. Which approach is most effective?

Brute-force the device passcode using a tool like 'hashcat'

Use a tool like 'keychain_dumper' on the memory image

Search the memory image for the 'bag' and 'keychain' data structures

Use a tool like 'ipsw' to extract keys from the image

An examiner has an encrypted APFS volume and a password hint that says the password is a common phrase with a number at the end. The examiner has a wordlist of common phrases. Which attack mode is most efficient?

Brute-force attack that tries all possible characters

Dictionary attack with the wordlist as-is

Rule-based attack that appends digits to each word in the wordlist

What is a key strategy when using brute-force techniques to access encrypted data on a macOS system?

Using a single high-speed computer to try all possible combinations sequentially

Using the same password for all user accounts

Starting with a dictionary of common passwords before moving to exhaustive combinations

Disabling the encryption to make the data accessible

An examiner wants to acquire memory from an iOS device. Which approach is a known limitation of iOS memory acquisition?

Memory acquisition can be performed by simply connecting via USB

iOS memory is encrypted and cannot be read even with a jailbreak

iOS devices do not have volatile memory

The device must be jailbroken to access the kernel memory space

An examiner has a macOS system with FileVault enabled. The user's password is unknown, but the examiner has a list of possible passwords. Which tool is most appropriate to attempt to unlock the FileVault volume?

Use 'diskutil' to reset the password

Use 'hdiutil' to attach the volume with a guessed password

Use 'passwd' command to change the user's password

Use 'fvde' tool from libfvde to brute-force the password

GIAC iOS and macOS Examiner

Domain 4Objective 3

Encrypted Container and Memory Analysis GIME Practice Questions (Page 1)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 10 practice questions to prepare you well beyond it. (estimate)

10questions here

2free pages

2concepts

Questions 1–5

1application · medium
An examiner has a memory image from an iOS device and wants to extract the encryption keys for the Keychain. Which approach is most effective?
Select an answer first
2expert · medium
An examiner has an encrypted APFS volume and a password hint that says the password is a common phrase with a number at the end. The examiner has a wordlist of common phrases. Which attack mode is most efficient?
Select an answer first
3foundation · easy
What is a key strategy when using brute-force techniques to access encrypted data on a macOS system?
Select an answer first
4foundation · easy
An examiner wants to acquire memory from an iOS device. Which approach is a known limitation of iOS memory acquisition?
Select an answer first
5application · medium
An examiner has a macOS system with FileVault enabled. The user's password is unknown, but the examiner has a list of possible passwords. Which tool is most appropriate to attempt to unlock the FileVault volume?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.