An examiner is investigating an iPhone that was used to take photos. The examiner needs to determine the GPS coordinates of the photos. The device is locked, but the examiner has the passcode. Which data source should be examined?

The device's Wi-Fi connection logs.

The device's cellular call logs.

An examiner needs to acquire evidence from a macOS system that is running a critical application that cannot be interrupted. The examiner must preserve the system's state as much as possible while still obtaining a forensic image of the disk. Which approach is most appropriate?

Use the system's built-in backup utility to create a backup.

Perform a logical collection of the application's data files only.

Shut down the system and remove the SSD for imaging.

Perform a live acquisition using a forensic tool that captures the disk while the system is running.

An examiner is investigating a macOS system that is part of a corporate environment with strict data privacy policies. The examiner needs to acquire evidence while minimizing the exposure of unrelated personal data. Which approach best balances the need for evidence and privacy?

Use the system's backup to retrieve only the relevant files.

Capture memory only and avoid disk imaging.

Create a full disk image immediately to ensure all evidence is preserved.

Perform a targeted logical collection of relevant files and folders, then create a full disk image only if necessary.

GIAC iOS and macOS Examiner

Domain 1Objective 1

Introduction to Apple Operating Systems GIME Practice Questions (Page 3)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

1concept

Questions 11–15

11application · medium
An examiner is investigating an iPhone that was used to take photos. The examiner needs to determine the GPS coordinates of the photos. The device is locked, but the examiner has the passcode. Which data source should be examined?
Select an answer first
12application · medium
An examiner needs to acquire evidence from a macOS system that is running a critical application that cannot be interrupted. The examiner must preserve the system's state as much as possible while still obtaining a forensic image of the disk. Which approach is most appropriate?
Select an answer first
13expert · hard
An examiner is investigating a macOS system that is part of a corporate environment with strict data privacy policies. The examiner needs to acquire evidence while minimizing the exposure of unrelated personal data. Which approach best balances the need for evidence and privacy?
Select an answer first
14foundation · easy
During a macOS examination, an examiner creates a bit-for-bit copy of the entire internal SSD. Which type of acquisition does this represent?
Select an answer first
15foundation · easy
An examiner needs to recover deleted files from a macOS system. Which type of data is most likely to contain remnants of deleted files?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Introduction to Apple Operating Systems GIME Practice Questions (Page 3)

Questions 11–15

An examiner is investigating an iPhone that was used to take photos. The examiner needs to determine the GPS coordinates of the photos. The device is locked, but the examiner has the passcode. Which data source should be examined?

An examiner needs to acquire evidence from a macOS system that is running a critical application that cannot be interrupted. The examiner must preserve the system's state as much as possible while still obtaining a forensic image of the disk. Which approach is most appropriate?

An examiner is investigating a macOS system that is part of a corporate environment with strict data privacy policies. The examiner needs to acquire evidence while minimizing the exposure of unrelated personal data. Which approach best balances the need for evidence and privacy?

During a macOS examination, an examiner creates a bit-for-bit copy of the entire internal SSD. Which type of acquisition does this represent?

An examiner needs to recover deleted files from a macOS system. Which type of data is most likely to contain remnants of deleted files?

Keep studying — Apple Operating System Fundamentals