Introduction to Apple Operating Systems GIME Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic examiner is asked to acquire evidence from a macOS system that is part of a corporate network. The system is currently powered off. The examiner needs to preserve the integrity of the evidence and ensure that the acquisition process does not alter any data on the drive. Which acquisition method is most appropriate?

   • APerform a logical collection of the user's files over the network.
   • BUse the built-in Disk Utility to create a read-only image of the drive.
   • CBoot the system from a forensic live CD and create an image of the internal drive.
   • DRemove the SSD and connect it to a forensic workstation using a write-blocker, then create a forensic image.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An examiner is asked to analyze a Mac that was used to create a document that was later deleted. The examiner needs to recover the document's content. The system has been powered off for two days. Which data source is most likely to contain the deleted document?

   • AThe system's unified log.
   • BThe system's unallocated disk space.
   • CThe system's Time Machine backup.
   • DThe system's memory dump.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A forensic examiner is called to acquire evidence from a macOS system that is part of a legal investigation. The system is running and the user is present. The examiner needs to ensure that the acquisition is legally defensible and does not alter any evidence. Which action is most appropriate?

   • AUse the system's built-in backup to create a copy of the data.
   • BAsk the user to close all applications and then create a disk image using Disk Utility.
   • CCapture memory using a trusted forensic tool, then shut down the system and image the drive with a write-blocker.
   • DPerform a live acquisition of the disk without capturing memory.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's security team needs to collect evidence from a macOS system that is suspected of being used to exfiltrate sensitive documents. The system is currently running, and the user is away. The team wants to preserve the state of the system for later analysis, including any running processes and network connections. Which action should the team take first?

   • ARun the built-in 'fsck' command to check the filesystem.
   • BCapture a memory dump using a trusted tool.
   • CCreate a full disk image using a hardware write blocker.
   • DCopy the contents of the user's home folder to an external drive.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During an incident response, an examiner needs to determine whether a user ran a specific command in the Terminal and what files were accessed around that time. The system is still running. Which combination of data sources would provide the most relevant evidence?

   • ASystem log and browser history.
   • BMemory dump and shell history files.
   • CFile system metadata and application usage logs.
   • DFull disk image and network logs.
   Reveal Solution Discussion Select an answer first