A forensic examiner is analyzing a macOS system and needs to identify which log sources are most likely to contain evidence of a user's web browsing activity. The examiner has access to the unified log, a plist file from the browser, and a SQLite database from the browser. Which combination of sources would provide the most comprehensive evidence?

The plist file and the SQLite database, because they contain browser configuration and history.

The unified log and the plist file, because they show system and configuration activity.

Only the SQLite database, because it contains the full browsing history.

The SQLite database and the unified log, because the database contains browsing history and the unified log captures network connections.

An examiner is investigating a macOS system for potential malware activity. The examiner has access to the unified log, a plist file from a suspicious launch agent, and a SQLite database from a security tool. Which log sources are most likely to contain evidence of the malware's persistence mechanism? Select all that apply.

The SQLite database from the security tool, because it may contain detection alerts.

The system's application log, because it records all application activity.

The plist file from the launch agent, because it defines the persistence mechanism.

The unified log, because it captures process launches and system events.

You are building a timeline from multiple log sources for a macOS system. You have unified log entries, application logs, and security logs. You notice that the system clock was adjusted by +5 minutes at 14:00. How should you handle this in your timeline?

Adjust all timestamps before 14:00 by subtracting 5 minutes to maintain consistency

Note the clock change in the timeline and keep all timestamps as recorded, but flag the discrepancy

Ignore the clock change because it does not affect the sequence of events

Use the adjusted time for all events after 14:00 to align with the new clock

You are investigating a macOS system for suspicious network activity. Which log would you prioritize to identify the process responsible for a specific network connection?

The security log, which records all network connections

The unified log, filtering for network-related events

The application log of the suspected app

The system.log file, which contains network connection records

GIAC iOS and macOS Examiner

Domain 2Objective 2

Log Analysis and Timeline Creation GIME Practice Questions (Page 2)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

5concepts

Questions 6–10

6application · medium
A forensic examiner is analyzing a macOS system and needs to identify which log sources are most likely to contain evidence of a user's web browsing activity. The examiner has access to the unified log, a plist file from the browser, and a SQLite database from the browser. Which combination of sources would provide the most comprehensive evidence?
Select an answer first
7application · medium · select all that apply
An examiner is investigating a macOS system for potential malware activity. The examiner has access to the unified log, a plist file from a suspicious launch agent, and a SQLite database from a security tool. Which log sources are most likely to contain evidence of the malware's persistence mechanism? Select all that apply.
Select an answer first
8application · medium
You are building a timeline from multiple log sources for a macOS system. You have unified log entries, application logs, and security logs. You notice that the system clock was adjusted by +5 minutes at 14:00. How should you handle this in your timeline?
Select an answer first
9application · medium
You are investigating a macOS system for suspicious network activity. Which log would you prioritize to identify the process responsible for a specific network connection?
Select an answer first
10foundation · easy
When constructing a timeline of events from log data, what is the first step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Log Analysis and Timeline Creation GIME Practice Questions (Page 2)

Questions 6–10

You are building a timeline from multiple log sources for a macOS system. You have unified log entries, application logs, and security logs. You notice that the system clock was adjusted by +5 minutes at 14:00. How should you handle this in your timeline?

You are investigating a macOS system for suspicious network activity. Which log would you prioritize to identify the process responsible for a specific network connection?

When constructing a timeline of events from log data, what is the first step?

Keep studying — Forensic Analysis and Artifacts