An examiner has an iOS backup that is encrypted. The examiner knows the password is a 6-digit PIN. The backup was created from an iPhone that has a feature that wipes the device after 10 failed passcode attempts. The examiner wants to avoid triggering the wipe on the device, but the backup is already extracted. Which approach is best?

Use a software exploit to disable the wipe on the device

Use a hardware tool to bypass the attempt limit on the device

Brute-force the backup password without worrying about the device wipe

Use a logical acquisition to extract more data from the device

During an incident response on a macOS system, the examiner needs to acquire memory but the system is a T2 chip-based Mac with a locked screen. The examiner has physical access and a known admin password. Which method is most appropriate?

Use the 'sudo' command with a tool like 'osxpmem' to acquire memory

Boot into recovery mode and use a memory acquisition tool

Use the built-in 'sudo dd' command to read /dev/mem

Use a kernel extension to dump memory

During an incident response on a macOS system, an examiner needs to capture the contents of the system's volatile memory. Which method is specifically designed for this task?

Using the `strings` command on the raw disk image

Using a tool like `lime` or `osxpmem` to create a memory image

Using the `fsck` command to verify the filesystem

Using the macOS `memory` command to dump RAM

A forensic examiner is investigating a macOS system that is suspected of running malware. The system is currently running, and the examiner has physical access. Which method should be used to acquire memory with the least impact on the system?

Use a kernel module to dump memory to a file

Use 'sudo strings /dev/mem' to extract memory

Use a hardware memory acquisition tool via Thunderbolt

Perform a cold boot attack to capture memory

GIAC iOS and macOS Examiner

Domain 4Objective 3

Encrypted Container and Memory Analysis GIME Practice Questions (Page 2)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 10 practice questions to prepare you well beyond it. (estimate)

10questions here

2free pages

2concepts

Questions 6–10

6expert · medium
An examiner has an iOS backup that is encrypted. The examiner knows the password is a 6-digit PIN. The backup was created from an iPhone that has a feature that wipes the device after 10 failed passcode attempts. The examiner wants to avoid triggering the wipe on the device, but the backup is already extracted. Which approach is best?
Select an answer first
7foundation · easy
When attempting to brute-force the passcode of an encrypted iOS backup, which tool is commonly used for this purpose?
Select an answer first
8application · medium
During an incident response on a macOS system, the examiner needs to acquire memory but the system is a T2 chip-based Mac with a locked screen. The examiner has physical access and a known admin password. Which method is most appropriate?
Select an answer first
9foundation · easy
During an incident response on a macOS system, an examiner needs to capture the contents of the system's volatile memory. Which method is specifically designed for this task?
Select an answer first
10application · medium
A forensic examiner is investigating a macOS system that is suspected of running malware. The system is currently running, and the examiner has physical access. Which method should be used to acquire memory with the least impact on the system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Encrypted Container and Memory Analysis GIME Practice Questions (Page 2)

Questions 6–10

When attempting to brute-force the passcode of an encrypted iOS backup, which tool is commonly used for this purpose?

During an incident response on a macOS system, the examiner needs to acquire memory but the system is a T2 chip-based Mac with a locked screen. The examiner has physical access and a known admin password. Which method is most appropriate?

During an incident response on a macOS system, an examiner needs to capture the contents of the system's volatile memory. Which method is specifically designed for this task?

A forensic examiner is investigating a macOS system that is suspected of running malware. The system is currently running, and the examiner has physical access. Which method should be used to acquire memory with the least impact on the system?

Keep studying — Incident Response and Advanced Techniques