A forensic examiner is called to investigate a macOS workstation that was used to access a web-based email service. The user is still logged in, and the machine has been running for several days. The examiner needs to preserve the contents of the user's webmail session, including any cached pages and cookies, while minimizing disruption to the running system. Which approach best satisfies the requirement?

Shut down the system and create a forensic image of the internal SSD.

Perform a live logical collection of the user's browser profile and capture RAM.

Use the built-in Time Machine backup to restore the system to a different Mac.

Copy the entire user's home folder to an external drive while the system is running.

A security analyst is investigating a macOS system that was used to send a malicious email. The analyst needs to determine the exact time the email was sent. The system's clock was synchronized with a time server. Which data source provides the most reliable timestamp?

The file system's creation time for the email file.

The email client's sent folder metadata.

A forensic examiner is investigating a macOS system that was used to access a secure website. The examiner needs to determine whether the user's password was captured in memory. The system has been running for several hours. Which type of data should the examiner analyze?

The browser's saved passwords database.

An examiner is investigating a macOS system where the user is suspected of using a full-disk encryption tool. The system is currently running and the user is logged in. The examiner needs to acquire evidence that includes decrypted data and also preserve the encrypted disk for later analysis. Which approach is most appropriate?

Shut down the system and remove the SSD for imaging.

Capture memory first to obtain the decryption key, then create a forensic image of the encrypted disk.

Use the system's built-in backup utility to create a backup of the decrypted data.

Perform a logical collection of the user's files while the system is running.

An examiner is investigating a macOS system that was used to access a corporate network. The examiner needs to determine whether the user used a VPN and, if so, which VPN server they connected to. The system is running, and the examiner has administrative access. The examiner wants to minimize the impact on the running system. Which approach is most appropriate?

Examine the system's VPN configuration files and logs.

Capture a memory dump and analyze it for VPN session information.

Perform a full disk image and analyze it later.

Use the 'netstat' command to view current network connections.

GIAC iOS and macOS Examiner

Domain 1Objective 1

Introduction to Apple Operating Systems GIME Practice Questions (Page 1)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

1concept

Questions 1–5

1application · medium
A forensic examiner is called to investigate a macOS workstation that was used to access a web-based email service. The user is still logged in, and the machine has been running for several days. The examiner needs to preserve the contents of the user's webmail session, including any cached pages and cookies, while minimizing disruption to the running system. Which approach best satisfies the requirement?
Select an answer first
2application · medium
A security analyst is investigating a macOS system that was used to send a malicious email. The analyst needs to determine the exact time the email was sent. The system's clock was synchronized with a time server. Which data source provides the most reliable timestamp?
Select an answer first
3application · medium
A forensic examiner is investigating a macOS system that was used to access a secure website. The examiner needs to determine whether the user's password was captured in memory. The system has been running for several hours. Which type of data should the examiner analyze?
Select an answer first
4expert · hard
An examiner is investigating a macOS system where the user is suspected of using a full-disk encryption tool. The system is currently running and the user is logged in. The examiner needs to acquire evidence that includes decrypted data and also preserve the encrypted disk for later analysis. Which approach is most appropriate?
Select an answer first
5expert · medium
An examiner is investigating a macOS system that was used to access a corporate network. The examiner needs to determine whether the user used a VPN and, if so, which VPN server they connected to. The system is running, and the examiner has administrative access. The examiner wants to minimize the impact on the running system. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Introduction to Apple Operating Systems GIME Practice Questions (Page 1)

Questions 1–5

A security analyst is investigating a macOS system that was used to send a malicious email. The analyst needs to determine the exact time the email was sent. The system's clock was synchronized with a time server. Which data source provides the most reliable timestamp?

A forensic examiner is investigating a macOS system that was used to access a secure website. The examiner needs to determine whether the user's password was captured in memory. The system has been running for several hours. Which type of data should the examiner analyze?

Keep studying — Apple Operating System Fundamentals