A forensic examiner is investigating a macOS system where the user may have used a USB drive to copy sensitive files. The examiner needs to determine if any files were copied to the USB drive and when. Which data sources would be most relevant?

Browser history and email archives.

System logs and filesystem metadata on the internal drive.

Full disk image of the USB drive only.

An examiner is investigating a macOS system that is part of a corporate network. The examiner needs to acquire evidence while minimizing the impact on the network and other users. The system is running and the examiner has remote access. Which approach is most appropriate?

Perform a logical collection of the user's files over the network.

Use the system's built-in backup to create a copy of the data.

Shut down the system and remove the SSD for imaging.

Perform a remote live acquisition of memory and disk over the network.

An examiner is asked to analyze a macOS system for evidence of malware. The examiner needs to identify running processes, network connections, and any suspicious files on disk. Which approach would provide the most comprehensive evidence?

Capture memory and create a full forensic image of the disk.

Collect only the system's log files.

Perform a logical collection of the system's Applications folder.

Use the built-in Activity Monitor to list processes and take a screenshot.

An examiner is investigating a macOS system that is part of a legal case. The examiner needs to acquire evidence that will be admissible in court. The system is running and the user is present. Which action is most important to ensure the evidence is admissible?

Use the system's built-in backup to create a copy of the data.

Capture memory and create a disk image as quickly as possible.

Ask the user to sign a consent form before acquiring evidence.

Document the entire acquisition process and use verified forensic tools.

An examiner needs to collect evidence from a Mac that was used to access a corporate VPN. The examiner wants to preserve the VPN configuration and any cached credentials. The system is running, and the examiner has administrative access. Which collection method is most appropriate?

Perform a logical collection of the system's configuration files and keychain.

Create a full disk image using a hardware write blocker.

Use the 'scutil' command to display the current VPN status.

Capture a memory dump to obtain the VPN session keys.

GIAC iOS and macOS Examiner

Domain 1Objective 1

Introduction to Apple Operating Systems GIME Practice Questions (Page 5)

Part of the Apple Operating System Fundamentals domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

1concept

Questions 21–25

21application · medium
A forensic examiner is investigating a macOS system where the user may have used a USB drive to copy sensitive files. The examiner needs to determine if any files were copied to the USB drive and when. Which data sources would be most relevant?
Select an answer first
22expert · hard
An examiner is investigating a macOS system that is part of a corporate network. The examiner needs to acquire evidence while minimizing the impact on the network and other users. The system is running and the examiner has remote access. Which approach is most appropriate?
Select an answer first
23application · medium
An examiner is asked to analyze a macOS system for evidence of malware. The examiner needs to identify running processes, network connections, and any suspicious files on disk. Which approach would provide the most comprehensive evidence?
Select an answer first
24expert · hard
An examiner is investigating a macOS system that is part of a legal case. The examiner needs to acquire evidence that will be admissible in court. The system is running and the user is present. Which action is most important to ensure the evidence is admissible?
Select an answer first
25application · medium
An examiner needs to collect evidence from a Mac that was used to access a corporate VPN. The examiner wants to preserve the VPN configuration and any cached credentials. The system is running, and the examiner has administrative access. Which collection method is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.