In the context of communication app analysis, what does the term 'VoIP' refer to?

Virtual Office Internet Protocol

An examiner is analyzing a macOS system where the user used Safari with a privacy-focused extension that blocks trackers. The examiner needs to determine if the user visited a specific website that is known to use trackers. Which data source would be most useful?

Safari's History.db, which may still record the visit even if trackers were blocked

The Mail application's Envelope Index, which may contain emails from the website

Cookies.binarycookies, which may contain cookies from the website

The extension's data folder, which may contain logs of blocked trackers

An examiner is analyzing a macOS device. The user used FaceTime to call a contact, then deleted the call history. The examiner needs to recover the call details. Which artifact is most likely to contain recoverable data?

The CallHistory.storedata database

An examiner is analyzing a macOS user's Safari data. The user claims they never visited a particular website, but the examiner finds evidence in the browser's cache. Which file should the examiner examine to determine if the website was actually visited?

~/Library/Caches/com.apple.Safari/Cache.db

~/Library/Safari/TopSites.plist

GIAC iOS and macOS Examiner

Domain 3Objective 2

Productivity Application Analysis GIME Practice Questions (Page 1)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

Questions 1–5

1foundation · medium
In the context of communication app analysis, what does the term 'VoIP' refer to?
Select an answer first
2expert · hard
An examiner is analyzing a macOS system where the user used Safari with a privacy-focused extension that blocks trackers. The examiner needs to determine if the user visited a specific website that is known to use trackers. Which data source would be most useful?
Select an answer first
3expert · hard
An examiner is analyzing a macOS device. The user used FaceTime to call a contact, then deleted the call history. The examiner needs to recover the call details. Which artifact is most likely to contain recoverable data?
Select an answer first
4application · medium
An examiner is analyzing a macOS user's Safari data. The user claims they never visited a particular website, but the examiner finds evidence in the browser's cache. Which file should the examiner examine to determine if the website was actually visited?
Select an answer first
5foundation · medium
When examining a Mail message stored on disk, which file format is used for individual email messages in the macOS Mail data store?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.