On macOS, which file stores Safari's user preferences, such as the home page and search engine settings?

~/Library/WebKit/com.apple.Safari.plist

~/Library/Application Support/Safari/config.plist

~/Library/Safari/Preferences.plist

~/Library/Preferences/com.apple.Safari.plist

An examiner is analyzing a macOS device. The user has a Mail account and uses Reminders. The examiner finds a reminder that references an email message. The examiner needs to determine if the email was actually sent. Which artifact would be most useful?

The 'ZDUEDATE' field in the Reminders database

The 'ZCOMPLETED' field in the Reminders database

The 'Sent' mailbox in the Mail data store

The 'Drafts' mailbox in the Mail data store

An examiner is analyzing a macOS system and needs to determine if a user had scheduled reminders related to a specific project. The user also used Mail and a messaging app. Which approach would be most effective?

Search the Calendar Cache database for reminders containing project-related keywords and cross-reference with Mail and messaging app data

Check Safari's History.db for project-related web searches

Analyze the messaging app's database for project-related messages

Examine the Mail Accounts.plist for project-related server names

An examiner is analyzing a macOS system where the user used Safari with a custom user agent and disabled JavaScript. The examiner needs to determine if the user accessed a website that requires JavaScript. Which data source would provide evidence of the visit?

Safari's History.db, which records the URL regardless of JavaScript being disabled

The Safari preferences plist, which may log JavaScript-disabled sites

The Safari cache, which may contain partial page content

The Cookies.binarycookies file, which may contain cookies from the site

GIAC iOS and macOS Examiner

Domain 3Objective 2

Productivity Application Analysis GIME Practice Questions (Page 3)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

Questions 11–15

11foundation · medium
On macOS, which file stores Safari's user preferences, such as the home page and search engine settings?
Select an answer first
12expert · hard
An examiner is analyzing a macOS device. The user has a Mail account and uses Reminders. The examiner finds a reminder that references an email message. The examiner needs to determine if the email was actually sent. Which artifact would be most useful?
Select an answer first
13expert · hard
An examiner is analyzing a macOS system and needs to determine if a user had scheduled reminders related to a specific project. The user also used Mail and a messaging app. Which approach would be most effective?
Select an answer first
14expert · hard
An examiner is analyzing a macOS system where the user used Safari with a custom user agent and disabled JavaScript. The examiner needs to determine if the user accessed a website that requires JavaScript. Which data source would provide evidence of the visit?
Select an answer first
15foundation · medium
When analyzing the Reminders app data, which piece of metadata is typically stored for each reminder item?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.