User Data and System Configuration GIME Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An examiner is analyzing an iOS device backup and needs to recover a user's notes. The backup is encrypted. Which approach is most likely to succeed?

   • AExtract the notes database directly from the backup without decryption
   • BUse a brute-force attack on the backup password
   • CUse a forensic tool that supports encrypted backups and provide the backup password
   • DLook for the notes in the unencrypted portion of the backup
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During an incident response on a macOS system, you need to determine if any system-wide launch daemons have been added or modified recently. Which directory should you focus on?

   • A/Library/LaunchDaemons
   • B/System/Library/LaunchDaemons
   • C/Library/Preferences
   • D~/Library/LaunchAgents
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A user reports that their macOS device suddenly shows a new wallpaper, a new screensaver, and a message 'Your device is managed by your organization' on the login screen. The user denies making these changes. As an incident responder, which artifact would be the most direct source of evidence to determine whether a configuration profile was installed?

   • A/var/db/ConfigurationProfiles/
   • B~/Library/Preferences/com.apple.wallpaper.plist
   • C/Library/Managed Preferences/
   • D/Library/Preferences/SystemConfiguration/com.apple.screensaver.plist
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   An investigator needs to find files that a user recently downloaded from the internet on a macOS system. Which directory should be examined first?

   • A~/Library/Application Support
   • B~/Documents
   • C/tmp
   • D~/Downloads
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A macOS device was compromised, and the attacker is suspected of modifying system configuration to maintain persistence. You find a launch daemon plist in /Library/LaunchDaemons/ that runs a script. However, the plist's modification time is older than the known compromise date. What is the most likely explanation?

   • AThe plist was installed as part of a software update that occurred before the compromise.
   • BThe attacker used a file timestamp manipulation tool to backdate the plist.
   • CThe plist was copied from another system and retains its original timestamp.
   • DThe plist was created by a legitimate application and is unrelated to the compromise.
   Reveal Solution Discussion Select an answer first