During a forensic examination of a macOS system, you need to identify the mail server settings that the user's Mail app is configured to use. Which file or database would you examine to find the outgoing mail server (SMTP) configuration?

~/Library/Preferences/com.apple.mail.plist

~/Library/Mail/V6/Accounts.plist

~/Library/Application Support/Mail/Accounts.plist

~/Library/Mail/V6/IMAP/INBOX.mbox

Where does Safari store its browsing history database on macOS?

~/Library/Preferences/com.apple.Safari.plist

~/Library/Caches/com.apple.Safari/History

~/Library/Application Support/Safari/History.sqlite

An examiner is analyzing a macOS Mail app data store. The examiner needs to determine the exact time a particular email was received. Which field in the email's metadata should the examiner examine?

The 'Date' header in the .emlx file

The 'Message-ID' header in the .emlx file

The 'Received' header in the .emlx file

The file creation timestamp of the .emlx file

GIAC iOS and macOS Examiner

Domain 3Objective 2

Productivity Application Analysis GIME Practice Questions (Page 7)

Part of the Application and Data Analysis domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

Questions 31–33

31foundation · medium
During a forensic examination of a macOS system, you need to identify the mail server settings that the user's Mail app is configured to use. Which file or database would you examine to find the outgoing mail server (SMTP) configuration?
Select an answer first
32foundation · medium
Where does Safari store its browsing history database on macOS?
Select an answer first
33application · medium
An examiner is analyzing a macOS Mail app data store. The examiner needs to determine the exact time a particular email was received. Which field in the email's metadata should the examiner examine?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.