You have built a timeline from multiple log sources. You notice that a key event appears in the unified log but is missing from the application log. What should you do?

Ignore the discrepancy because the unified log is more reliable

Assume the event did not happen because it is not in the application log

Remove the event from the timeline to maintain consistency

Check if the application log was rotated or truncated

During timeline validation, an analyst finds that a log entry's timestamp is inconsistent with the system's timezone settings. What should the analyst do?

Note the inconsistency and document the timezone used

Adjust the timestamp to match the system timezone

Remove the entry from the timeline

You have created a timeline from macOS unified logs and iOS device logs. You notice that a particular event on the iOS device appears to occur 3 seconds before a related event on the macOS system, but the timestamps are from different time zones. What is the most appropriate action?

Assume the iOS event happened first because it is earlier in the local time

Flag the event as an anomaly and exclude it from the timeline

Convert all timestamps to UTC and then re-evaluate the sequence

Adjust the macOS timestamps to match the iOS timezone

GIAC iOS and macOS Examiner

Domain 2Objective 2

Log Analysis and Timeline Creation GIME Practice Questions (Page 6)

Part of the Forensic Analysis and Artifacts domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

5concepts

Questions 26–28

26expert · hard
You have built a timeline from multiple log sources. You notice that a key event appears in the unified log but is missing from the application log. What should you do?
Select an answer first
27foundation · easy
During timeline validation, an analyst finds that a log entry's timestamp is inconsistent with the system's timezone settings. What should the analyst do?
Select an answer first
28expert · hard
You have created a timeline from macOS unified logs and iOS device logs. You notice that a particular event on the iOS device appears to occur 3 seconds before a related event on the macOS system, but the timestamps are from different time zones. What is the most appropriate action?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.

Log Analysis and Timeline Creation GIME Practice Questions (Page 6)

Questions 26–28

You have built a timeline from multiple log sources. You notice that a key event appears in the unified log but is missing from the application log. What should you do?

During timeline validation, an analyst finds that a log entry's timestamp is inconsistent with the system's timezone settings. What should the analyst do?

You have created a timeline from macOS unified logs and iOS device logs. You notice that a particular event on the iOS device appears to occur 3 seconds before a related event on the macOS system, but the timestamps are from different time zones. What is the most appropriate action?

Keep studying — Forensic Analysis and Artifacts