Introduction to Apple Operating Systems GIME Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A forensic examiner is working on a case involving a macOS system that was used to access a cloud storage service. The examiner needs to determine which files were uploaded and when, and also identify any local copies of those files. Which combination of data sources would be most useful?

   • AMemory dump and network logs from the corporate firewall.
   • BFull disk image and browser history.
   • CSystem logs and user's email archive.
   • DFilesystem metadata and application logs from the cloud storage client.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A forensic examiner is investigating a Mac that was used to access a web-based email account. The examiner needs to recover the user's password, which may be stored in the browser's saved passwords. The system is running, and the examiner has the user's login credentials. Which approach is most likely to recover the password?

   • APerform a full disk image and use a forensic tool to extract the password.
   • BUse the browser's 'show password' feature while logged in.
   • CCopy the browser's password database and crack the encryption.
   • DCapture a memory dump and search for the password in plaintext.
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   An examiner is investigating a macOS system that is suspected of being compromised by malware. The examiner needs to determine the extent of the compromise and identify any data that was exfiltrated. The system is running and the examiner has limited time before the system may be shut down by IT. Which approach is most appropriate?

   • APerform a logical collection of the system's log files.
   • BCapture memory immediately, then create a full disk image.
   • CShut down the system immediately to prevent further damage.
   • DUse the system's built-in antivirus to scan for malware.
   Reveal Solution Discussion Select an answer first