An incident responder is analyzing a macOS system and needs to determine if any configuration profiles were installed and then removed. Which artifact would provide evidence of this activity?

The user's ~/Library/Preferences folder

The /Library/Managed Preferences/ folder

The /var/db/ConfigurationProfiles/Store/profiles.plist

A macOS device was used to access a confidential database. The user claims they only used a web browser, but you suspect they used a native database client. Which user data artifact would provide the most reliable evidence of the database client being used?

The user's Safari history, which may show the database's web interface.

The database client's preferences plist, which may store recent connection strings.

The user's bash history, which may show command-line database commands.

The system's unified log, which may record network connections to the database server.

During an incident response, you need to determine whether a user accessed a specific document on their macOS device. The document is stored in the user's Documents folder. Which combination of artifacts would provide the most comprehensive evidence of access?

The file's access time (atime) and the user's bash history

The file's access time (atime) and the unified log entries for the application that opened it

The file's metadata (creation, modification, access times) and the application's recent documents list

The file's Spotlight index and the user's browser history

An investigator is examining a macOS system and finds a suspicious file in the user's ~/Library/Application Support folder. The file has a creation date that predates the user's account creation. What is the most likely explanation?

The file's creation date is inaccurate due to system clock changes

The file was restored from a backup or migrated from another system

The file was created by a system process and is not user-specific

The file was created by malware that spoofed the creation date

An examiner is analyzing an iOS device backup and needs to locate the user's text message attachments. In the backup structure, where would these attachments typically be found?

In the SQLite database file for the SMS/MMS app

In the Library/SMS/Attachments folder within the backup

In the Library/Mail/Attachments folder within the backup

In the Media/PhotoData folder within the backup

GIAC iOS and macOS Examiner

Domain 4Objective 4

User Data and System Configuration GIME Practice Questions (Page 2)

Part of the Incident Response and Advanced Techniques domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 4–6 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

4concepts

Questions 6–10

6expert · hard
An incident responder is analyzing a macOS system and needs to determine if any configuration profiles were installed and then removed. Which artifact would provide evidence of this activity?
Select an answer first
7expert · hard
A macOS device was used to access a confidential database. The user claims they only used a web browser, but you suspect they used a native database client. Which user data artifact would provide the most reliable evidence of the database client being used?
Select an answer first
8expert · hard
During an incident response, you need to determine whether a user accessed a specific document on their macOS device. The document is stored in the user's Documents folder. Which combination of artifacts would provide the most comprehensive evidence of access?
Select an answer first
9expert · hard
An investigator is examining a macOS system and finds a suspicious file in the user's ~/Library/Application Support folder. The file has a creation date that predates the user's account creation. What is the most likely explanation?
Select an answer first
10application · medium
An examiner is analyzing an iOS device backup and needs to locate the user's text message attachments. In the backup structure, where would these attachments typically be found?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GIME

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GIME” is a trademark of its owner, used for identification only.