During an iOS incident, you have a non-jailbroken device and need to determine if a malicious app is accessing sensitive data. The device is currently unlocked. Which approach would be most effective given the device's non-jailbroken state?

Attempt to jailbreak the device to gain root access

Use the device's built-in diagnostics and backup to extract app data

Ask the user to manually open the app and observe its behavior

Use a hardware forensic tool to read the device's memory

During an incident, you need to determine if a macOS system is communicating with a known malicious server. Which volatile artifact would provide the most direct evidence?

The list of active network connections with associated process IDs.

The list of installed applications and their versions.

The system's uptime and last reboot time.

The contents of the user's browser history.

On a compromised macOS system, you find a modified plist in ~/Library/Preferences that launches a background process at login. The process is currently running. Which step would provide the most complete picture of the persistence mechanism?

Check the system's DNS cache for suspicious domains

Analyze the plist's contents and the running process's command-line arguments

Delete the plist and reboot the system

Review the user's bash history for commands

You are investigating a macOS system where malware has created a new user account and added a LaunchAgent for that user. Which artifacts would you examine to confirm the persistence and the account's creation?

The system's printer spooler logs

The system's kernel extensions and device drivers

The user account database and the LaunchAgent plist

During an incident on an iOS device, you suspect a malicious profile has been installed that forces traffic through a proxy. The device is not jailbroken. Which volatile or persistent artifact would you examine to confirm the profile's presence and its network effect?

The device's wallpaper settings

The device's battery usage statistics

The device's configuration profile list and current network connections

GIAC iOS and macOS Examiner

Domain 4Objective 2

Incident Response GIME Practice Questions (Page 2)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

2concepts

Questions 6–10

6expert · hard
During an iOS incident, you have a non-jailbroken device and need to determine if a malicious app is accessing sensitive data. The device is currently unlocked. Which approach would be most effective given the device's non-jailbroken state?
Select an answer first
7application · medium
During an incident, you need to determine if a macOS system is communicating with a known malicious server. Which volatile artifact would provide the most direct evidence?
Select an answer first
8application · medium
On a compromised macOS system, you find a modified plist in ~/Library/Preferences that launches a background process at login. The process is currently running. Which step would provide the most complete picture of the persistence mechanism?
Select an answer first
9application · medium
You are investigating a macOS system where malware has created a new user account and added a LaunchAgent for that user. Which artifacts would you examine to confirm the persistence and the account's creation?
Select an answer first
10application · medium
During an incident on an iOS device, you suspect a malicious profile has been installed that forces traffic through a proxy. The device is not jailbroken. Which volatile or persistent artifact would you examine to confirm the profile's presence and its network effect?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.